非对称密钥与护照JWT。验证始终返回未经授权。

Question

我正在开发一个应用程序，并且希望从一开始就实现安全性，因此我创建了一个私钥/公钥对，并像以下方式设置passport-jwt（key是密钥对的公钥部分）：

(passport, key) => {
  const opts = {
    jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
    secretOrKey: key
  };
   passport.use(
     new JwtStrategy(opts, (payload, done) => {
       log.info({message: 'verifying the token', payload});
       User.findById(payload.id)
         .then(user => {
           if (user) {
             return done(null, {
               id: user._id,
               name: user.userName,
               email: user.emailAddress
             });
           }
           log.info(payload);
           return done(null, false);
         })
         .catch(err => {
           log.error(err)
           return done('Unauthorized', false, payload);
          });
     })
   );
};

当用户登录时，我会使用私钥对令牌进行签名，方法如下：

router.post('/login', (req, res) => {
        const email = req.body.email;
        const password = req.body.password;

        User.findOne({ email }).then(user => {
            if (!user) {
                errors.email = 'No Account Found';
                return res.status(404).json(errors);
            }

            bcrypt.compare(password, user.password).then(isMatch => {
                if (isMatch) {
                    const payload = {
                        id: user._id,
                        name: user.userName,
                        email: user.emailAddress
                    };
                    log.info(payload);
                    jwt.sign(payload, private, { expiresIn: 30000000 }, (err, token) => {
                        if (err)
                            res.status(500).json({ error: 'Error signing token', raw: err });
                        // const refresh = uuid.v4();
                        res.json({ success: true, token: `Bearer ${token}` });
                    });
                } else {
                    errors.password = 'Password is incorrect';
                    res.status(400).json(errors);
                }
            });
        });
    });

我感觉可能有些东西我没考虑到，但我不确定是什么。

此外，在应用程序初始化时，我也使用以下代码在应用内生成密钥。

const ensureKeys = () => {
    return new Promise((resolve, reject) => {
        ensureFolder('./keys').then(() => {
            /**
             * Ensure that both the private and public keys
             * are created, and if not create them both.
             * Never generate just a single key.
             */
            try {
                if (
                    !fs.existsSync('./keys/private.key') &&
                    !fs.existsSync('./keys/public.key')
                ) {
                    log.info('Keys do not exist. Creating them.');
                    diffHell.generateKeys('base64');
                    const public = diffHell.getPublicKey('base64');
                    const private = diffHell.getPrivateKey('base64');
                    fs.writeFileSync('./keys/public.key', public);
                    fs.writeFileSync('./keys/private.key', private);
                    log.info('keys created and being served to the app.');
                    resolve({ private, public });
                } else {
                    log.info('keys are already generated. Loading from key files.');
                    const public = fs.readFileSync('./keys/public.key');
                    const private = fs.readFileSync('./keys/private.key');
                    log.info('keys loaded from files. Serving to the rest of the app.');
                    resolve({ private, public });
                }
            } catch (e) {
                log.error('issue loading or generating keys. Sorry.', e);
                reject(e);
            }
        });
    });
};

- Chris Rutherford

Answer 1

好的，问题出在两个方面。首先，我在为护照生成密钥时出错了。根据 passport-jwt 的文档，密钥必须以 PEM 格式编码；根据这篇在Medium上的文章，还需要对护照和 JWT 进行更多配置。

最终解决方案包括使用可在 npm 上获得的keypair库。

以下是修改后的代码，可以使其正常工作。

const keypair = require('keypair');
const ensureKeys = () => {
    return new Promise((resolve, reject) => {
        ensureFolder('./keys').then(() => {
            /**
             * Ensure that both the private and public keys
             * are created, and if not create them both.
             * Never generate just a single key.
             */
            try {
                if (
                    !fs.existsSync('./keys/private.key') &&
                    !fs.existsSync('./keys/public.key')
                ) {
                    log.info('Keys do not exist. Creating them.');
                    const pair = keypair();
                    fs.writeFileSync('./keys/public.key', pair.public);
                    fs.writeFileSync('./keys/private.key', pair.private);
                    log.info('keys created and being served to the app.');
                    resolve({ private: pair.private,public: pair.public });
                } else {
                    log.info('keys are already generated. Loading from key files.');
                    const public = fs.readFileSync('./keys/public.key', 'utf8');
                    const private = fs.readFileSync('./keys/private.key', 'utf8');
                    log.info('keys loaded from files. Serving to the rest of the app.');
                    resolve({ private, public });
                }
            } catch (e) {
                log.error('issue loading or generating keys. Sorry.', e);
                reject(e);
            }
        });
    });
};

密钥是用私钥签名的，私钥不应该被分享。

    router.post('/login', (req, res) => {
        const { errors, isValid } = require('../validation/user').loginUser(
            req.body
        );
        if (!isValid) {
            return res.status(400).json(errors);
        }
        const email = req.body.email;
        const password = req.body.password;

        User.findOne({ email }).then(user => {
            if (!user) {
                errors.email = 'No Account Found';
                return res.status(404).json(errors);
            }

            bcrypt.compare(password, user.password).then(isMatch => {
                if (isMatch) {
                    const payload = {
                        id: user._id,
                        name: user.userName,
                        email: user.emailAddress
                    };
                    log.info(payload);
                    jwt.sign(payload, private, { 
                        expiresIn: 30000000,
                        subject: user.emailAddress,
                        algorithm: 'RS256'
                     }, (err, token) => {
                        if (err)
                            res.status(500).json({ error: 'Error signing token', raw: err });
                        res.json({ success: true, token: `Bearer ${token}` });
                    });
                } else {
                    errors.password = 'Password is incorrect';
                    res.status(400).json(errors);
                }
            });
        });

而且还有验证函数：

  const opts = {
    jwtFromRequest: ExtractJwt.fromAuthHeaderWithScheme('Bearer'),
    secretOrKey: key,
    algorithm: ["RS256"]
  };
passport.use(
     new JwtStrategy(opts, (payload, done) => {
       log.info({message: 'verifying the token', payload});
       User.findById(payload.id)
         .then(user => {
           if (user) {
             return done(null, {
               id: user._id,
               name: user.userName,
               email: user.emailAddress
             });
           }
           log.info(payload);
           return done(null, false);
         })
         .catch(err => {
           log.error(err)
           return done('Unauthorized', false, payload);
          });
     })
   );

我希望这对未来想要使用非对称密钥的人有所帮助。

- Chris Rutherford

---

我没有遇到这个问题，因为我找不到有关如何实际执行非对称密钥的资源。谢谢您的发布！ - user9844377

Answer 2

很好，这对我有帮助，谢谢。

如果对其他人有用的话，我没有使用库 - 找到了一个链接，解释了如何将公钥转换为PEM格式，似乎可以工作（私钥已经是正确的格式）

ssh-keygen -f id_rsa.pub -m 'PEM' -e > id_rsa.pem

我的问题

- NickW