JWT 与 cookie 用于基于令牌的身份验证

JWT（JSON Web Token）和cookie是两种常用的基于令牌的身份验证方式。在本文中，我们将探讨这两种方式的特点和使用场景，并提供一些案例代码来说明它们的用法。

javascript
const jwt = require('jsonwebtoken');
// 生成JWT
const generateToken = (user) => {
  const payload = {
    id: user.id,
    username: user.username,
    role: user.role,
  };
  const secretKey = 'your-secret-key';
  const options = {
    expiresIn: '1h',
  };
  return jwt.sign(payload, secretKey, options);
};
// 验证JWT
const verifyToken = (token) => {
  const secretKey = 'your-secret-key';
  try {
    const decoded = jwt.verify(token, secretKey);
    return decoded;
  } catch (error) {
    throw new Error('Invalid token');
  }
};

javascript
const express = require('express');
const cookieParser = require('cookie-parser');
const app = express();
app.use(cookieParser());
// 登录接口
app.post('/login', (req, res) => {
  const { username, password } = req.body;
  // 验证用户名和密码
  if (username === 'admin' && password === '123456') {
    // 生成cookie
    const user = {
      id: 1,
      username: 'admin',
      role: 'admin',
    };
    const options = {
      maxAge: 3600000, // 过期时间为1小时
      httpOnly: true, // 仅允许通过HTTP访问cookie
    };
    res.cookie('token', JSON.stringify(user), options);
    res.sendStatus(200);
  } else {
    res.sendStatus(401);
  }
});
// 验证接口
app.get('/profile', (req, res) => {
  const token = req.cookies.token;
  if (token) {
    const user = JSON.parse(token);
    res.json(user);
  } else {
    res.sendStatus(401);
  }
});
app.listen(3000, () => {
  console.log('Server is running on port 3000');
});