如何在 Node JS JWT 身份验证中设置角色？

Question

我是 Node JS 的新手，现在我正在学习如何在我的 Rest API 中使用 JWT 身份验证 我已经在我的登录功能中制作了令牌生成器，但是当我尝试通过设置某个角色来验证令牌时，如果角色等于 2，我可以获得数据。现在我遇到了麻烦，因为我无法验证我的令牌

登录：

exports.login = function(req, res){
    var post = {
        email : req.body.email,
        password : req.body.password
    }

    var query = "SELECT * FROM ?? WHERE ?? = ? AND ?? = ?";
    var table = ["user", "password", md5(post.password), "email",post.email];

    query = mysql.format(query,table);

    connection.query(query, function(error, rows){
        if(error){
            console.log(error);
        }else{
            if (rows.length == 1){
                //ini 1440 dalam second
                var token = jwt.sign({rows}, config.secret);
                id_user = rows[0].id;
                username = rows[0].username;
                email = rows[0].email;
                tanggal_daftar = rows[0].tanggal_daftar;
                role = rows[0].role;

                var data = {
                    id_user : id_user,
                    access_token : token,
                    username : username,
                    email : email,
                    tanggal_daftar : tanggal_daftar,
                    role : role,
                    ip_address : ip.address()
                }

                res.json({
                     success : true,
                     message : "Token JWT generate",
                     token : token,
                     idUser: data.id_user,
                     username : username,
                     email : data.email,
                     tanggal_daftar : tanggal_daftar,
                     role : data.role
                    });

            }else{
                 res.json({"Error": true, "Message":"Email atau password anda salah"});
            }
        }
    });
}

令牌检查：

const jwt = require('jsonwebtoken');
const config = require('../config/secret');

function verifikasi(role){
    return function (req, rest, next){
    // var role = req.body.role;
        //cek authorization header
        var tokenWithBearer = req.headers.authorization;
        if(tokenWithBearer){
            var token = tokenWithBearer.split(' ')[1];
            //verifikasi
            jwt.verify(token, config.secret, function(err, decoded){
                if(err){
                    return rest.status(401).send({auth:false, message:"Token tidak terdaftar!"});
                }else{
                    if(role == 2){
                        req.auth = decoded;
                        next();
                    }else{
                        return rest.status(401).send({auth:false, message:"gagal melakukan otorisasi!"});
                    }
                }
            });
        }else{
            return rest.status(401).send({auth:false, message:"Token tidak tersedia!"});
        }
    }
}

module.exports = verifikasi;

索引：

// alamat dengan otoritas khusus
router.get('/api/v1/rahasia', verifikasi(), auth.halamanrahasia);

Answer 1

你的if(role == 2)有错误，你应该把它改成(decoded.role == 2)

编辑：将if(role == 2) 更改为if(decoded.rows.role == 2)