Koa middleware that validates JSON Web Tokens and sets ctx.state.user (by default) if a valid token is provided.
wemall open source micro mall, WeChat mall, mall source code, three-level distribution, micro fresh food, micro fruit, micro takeaway, micro ordering---professional o2o system
koa-jwt

Koa JWT authentication middleware.

koa-jwt

Koa middleware that validates JSON Web Tokens and sets ctx.state.user (by default) if a valid token is provided.
This module lets you authenticate HTTP requests using JSON Web Tokens in your Koa (node.js) applications.
See this article for a good introduction.
Install$?npm?install?koa-jwtUsage
The JWT authentication middleware authenticates callers using a JWT token. If the token is valid, ctx.state.user (by default) will be set with the JSON object decoded to be used by later middleware for authorization and access control.
The token is normally provided in a HTTP header (Authorization), but it can also be provided in a cookie by setting the opts.cookie option to the name of the cookie that contains the token. Custom token retrieval can also be done through the opts.getToken option. The provided function is called in the normal Koa context and should return the retrieved token.
Normally you provide a single shared secret in opts.secret, but another alternative is to have an earlier middleware set ctx.state.secret, typically per request. If this property exists, it will be used instead of the one in opts.secret.

Examplevar?koa?=?require('koa');<br> var?jwt?=?require('koa-jwt');<br> ?<br> var?app?=?koa();<br> ?<br> //?Custom?401?handling?if?you?don't?want?to?expose?koa-jwt?errors?to?users?<br> app.use(function?*(next){<br> ??try?{<br> ????yield?next;<br> ??}?catch?(err)?{<br> ????if?(401?==?err.status)?{<br> ??????this.status?=?401;<br> ??????this.body?=?'Protected?resource,?use?Authorization?header?to?get?accessn';<br> ????}?else?{<br> ??????throw?err;<br> ????}<br> ??}<br> });<br> ?<br> //?Unprotected?middleware?<br> app.use(function?*(next){<br> ??if?(this.url.match(/^/public/))?{<br> ????this.body?=?'unprotectedn';<br> ??}?else?{<br> ????yield?next;<br> ??}<br> });<br> ?<br> //?Middleware?below?this?line?is?only?reached?if?JWT?token?is?valid?<br> app.use(jwt({?secret:?'shared-secret'?}));<br> ?<br> //?Protected?middleware?<br> app.use(function?*(){<br> ??if?(this.url.match(/^/api/))?{<br> ????this.body?=?'protectedn';<br> ??}<br> });<br> ?<br> app.listen(3000);
Alternatively you can conditionally run the jwt middleware under certain conditions:var?koa?=?require('koa');<br> var?jwt?=?require('koa-jwt');<br> ?<br> var?app?=?koa();<br> ?<br> //?Middleware?below?this?line?is?only?reached?if?JWT?token?is?valid?<br> //?unless?the?URL?starts?with?'/public'?<br> app.use(jwt({?secret:?'shared-secret'?}).unless({?path:?[/^/public/]?}));<br> ?<br> //?Unprotected?middleware?<br> app.use(function?*(next){<br> ??if?(this.url.match(/^/public/))?{<br> ????this.body?=?'unprotectedn';<br> ??}?else?{<br> ????yield?next;<br> ??}<br> });<br> ?<br> //?Protected?middleware?<br> app.use(function?*(){<br> ??if?(this.url.match(/^/api/))?{<br> ????this.body?=?'protectedn';<br> ??}<br> });<br> ?<br> app.listen(3000);
For more information on unless exceptions, check koa-unless.
You can also add the passthrough option to always yield next, even if no valid Authorization header was found:app.use(jwt({?secret:?'shared-secret',?passthrough:?true?}));This lets downstream middleware make decisions based on whether ctx.state.user is set.
If you prefer to use another ctx key for the decoded data, just pass in key, like so:app.use(jwt({?secret:?'shared-secret',?key:?'jwtdata'?}));
This makes the decoded data available as ctx.state.jwtdata.
You can specify audience and/or issuer as well:app.use(jwt({?secret:???'shared-secret',<br> ??????????????audience:?'http://myapi/protected',<br> ??????????????issuer:???'http://issuer'?}));If the JWT has an expiration (exp), it will be checked.
This module also support tokens signed with public/private key pairs. Instead of a secret, you can specify a Buffer with the public key:
var?publicKey?=?fs.readFileSync('/path/to/public.pub');<br> app.use(jwt({?secret:?publicKey?}));
Related Modules
jsonwebtoken — JSON Web Token signing and verification
Note that koa-jwt exports the sign, verify and decode functions from the above module as a convenience.
Tests
$ npm install
$ npm test
Author
Stian Gryt?yr
Credits
This code is largely based on express-jwt.
Auth0
Matias Woloski
Contributors
Foxandxss
soygul
tunnckoCore
getuliojr
cesarandreu
michaelwestphal
sc0ttyd
Jackong
danwkennedy
Licens
The MIT License

wemall 開(kāi)源微商城 ，微信商城，商城源碼，三級(jí)分銷(xiāo)，微生鮮，微水果，微外賣(mài)，微訂餐---專業(yè)的o2o系統(tǒng)
wemall地址：http://www.wemallshop.com

代碼來(lái)源：http://js.koahub.com/home/feature/koa-jwt