当前位置：首页 > 软件库 > Web应用开发 > >

express-jwt-permissions

🚦 Express middleware for JWT permissions

授权协议 MIT License

开发语言 JavaScript

所属分类 Web应用开发

软件类型开源软件

地区不详

投递者周学义

操作系统跨平台

开源组织无

适用人群未知

软件概览

Express JWT Permissions

Middleware that checks JWT tokens for permissions, recommended to be used in conjunction with express-jwt.

Install

npm install express-jwt-permissions --save

Usage

This middleware assumes you already have a JWT authentication middleware such as express-jwt.

The middleware will check a decoded JWT token to see if a token has permissions to make a certain request.

Permissions should be described as an array of strings inside the JWT token, or as a space-delimited OAuth 2.0 Access Token Scope string.

"permissions": [
  "status",
  "user:read",
  "user:write"
]

"scope": "status user:read user:write"

If your JWT structure looks different you should map or reduce the results to produce a simple Array or String of permissions.

Using permission Array

To verify a permission for all routes using an array:

var guard = require('express-jwt-permissions')()

app.use(guard.check('admin'))

If you require different permissions per route, you can set the middleware per route.

var guard = require('express-jwt-permissions')()

app.get('/status', guard.check('status'), function(req, res) { ... })
app.get('/user', guard.check(['user:read']), function(req, res) { ... })

Logical combinations of required permissions can be made using nested arrays.

Single string

// Required: "admin"
app.use(guard.check(
  'admin'
))

Array of strings

// Required: "read" AND "write"
app.use(guard.check(
  ['read', 'write']
))

Array of arrays of strings

// Required: "read" OR "write"
app.use(guard.check([
  ['read'],
  ['write']
]))

// Required: "admin" OR ("read" AND "write")
app.use(guard.check([
  ['admin'],
  ['read', 'write']
]))

Configuration

To set where the module can find the user property (default req.user) you can set the requestProperty option.

To set where the module can find the permissions property inside the requestProperty object (default permissions), set the permissionsProperty option.

Example:

Consider you've set your permissions as scope on req.identity, your JWT structure looks like:

"scope": "user:read user:write"

You can pass the configuration into the module:

var guard = require('express-jwt-permissions')({
  requestProperty: 'identity',
  permissionsProperty: 'scope'
})

app.use(guard.check('user:read'))

Error handling

The default behavior is to throw an error when the token is invalid, so you can add your custom logic to manage unauthorized access as follows:

app.use(guard.check('admin'))

app.use(function (err, req, res, next) {
  if (err.code === 'permission_denied') {
    res.status(403).send('Forbidden');
  }
});

Note that your error handling middleware should be defined after the jwt-permissions middleware.

Excluding paths

This library has integration with express-unless to allow excluding paths, please refer to their usage.

const checkForPermissions = guard
  .check(['admin'])
  .unless({ path: '/not-secret' })

app.use(checkForPermissions)

Tests

$ npm install
$ npm test

License

This project is licensed under the MIT license. See the LICENSE file for more info.

使用案例

jwt在node中的应用与实践

导语：由于http是无状态的，请求响应过程中不存储记录用户身份信息，所以就出现了很多用户识别存储用户身份的方法，比如cookie，session，jwt。我最近做的一个接口服务使用了jwt来存储管理用户信息，相较于本地cookie存储，服务器端session存储，jwt就变得比较安全和节省方便，本文就jwt在node服务中的使用方法做一个简单的总结。目录 jwt简介安装配置封装方法实战练习
从Django,Flask到Express(四）Session和JWT

Django Session 登录，登出演示前端 vue3 <template> <div> <button v-if="loggedIn" @click="logout">退出</button> <div v-else> <input type="text" v-model="username" placeholder="用户名" /> <input
laravel 验证jwt_使用JWT在Laravel中基于角色的身份验证

laravel 验证jwt From personal experience, no JWT (JSON Web Token) library incorporates a feature for role-based authentication, at least for my core languages which are Node, PHP, C# and Java. In as muc
SpringBoot Security整合JWT授权RestAPI

本教程主要详细讲解SpringBoot Security整合JWT授权RestAPI。基础环境技术版本 Java 1.8+ SpringBoot 2.x.x Security 5.x JWT 0.9.0 创建项目初始化项目 mvn archetype:generate -DgroupId=com.edurt.sli.slisj -DartifactId=spring-learn-integ

express-jwt-permissions

Express JWT Permissions

Install

Usage

Using permission Array

Configuration

Error handling

Excluding paths

Tests

License

同类工具

相关阅读

相关文章

相关问答

相关文档