jwt 阻止我查看其他用户的个人资料 nodejs, angular

Question

我遵循了有关如何创建身份验证系统的教程。在按照教程进行时，我尝试尽可能多地理解，但有些东西我仍然没有得到，现在我遇到了一个问题，我尝试了很多方法来解决，但答案仍然是否定的。问题是 jwt 中间件只允许我查看我登录的用户的个人资料，但我不希望这样，我希望一个用户能够看到所有其他用户的个人资料，我怎么能去做？提前致谢！！ 对于后端，这是我的“user.route.js”

router.get("/profile/:id",auth, async (req, res) => {

    try {
      // request.user is getting fetched from Middleware after token authentication
      const user = await User.findById(req.user.id);
      res.json(user);
    } catch (e) {
      res.send({ message: "Error in Fetching user" });
    }
  });

对于前端，这是我的“authentication.service.ts”

export interface UserDetails{
  username: string
  email: string
  password: string
  firstName: string
  lastName: string
  exp: number
  iat: number
}
interface TokenResponse{
  token: string
}
export interface TokenPayload{
  username: string
  email: string
  password: string
  firstName: string
  lastName: string
}
@Injectable({
  providedIn: 'root'
})
export class AuthenticationService {
  private token: string

  constructor(private http: HttpClient, private router: Router) {}

  private saveToken(token: string): void{
    localStorage.setItem('usertoken', token)
    this.token = token
  }
  private getToken(): string{
    if(!this.token){
      this.token = localStorage.getItem('usertoken')
    }
    return this.token
  }
  public getUserDetails(): UserDetails{
    const token = this.getToken()
    let payload
    if(token){
      payload = token.split('.')[1]
      payload = window.atob(payload)
      return JSON.parse(payload)
    }else{
      return null
    }
  }
  public isLoggedIn(): boolean{
    const user = this.getUserDetails()
    if(user){
      return user.exp > Date.now()/ 1000
    }
    else{
      return false
    }
  }
  public login(user: TokenPayload): Observable<any>{
    const base = this.http.post('/user/login', user)
    const request = base.pipe(
      map((data: TokenResponse) => {
        if(data.token){
          this.saveToken(data.token)
        }return data
      })
    )
    return request
  }
  public register(user: TokenPayload) : Observable<any>{
    const base = this.http.post('/user/register', user)
    const request = base.pipe(
      map((data: TokenResponse) => {
        if(data.token){
          this.saveToken(data.token)
        }
        return data
      })
    )
    return request
  }
  public profile(id): Observable<any>{
    const username = this.getUserDetails().username
    return this.http.get(`/user/profile/${id}`,
    {
      headers: {Authorization: `${this.getToken()}`}
    })
  }
  public logout(): void{
    this.token = ''
    window.localStorage.removeItem('usertoken')
    this.router.navigateByUrl('/')
  }

}

这是“profile.component.ts”代码

 ngOnInit() {
    
    this.route.params.subscribe(params => {
      const id = params.id;
      this.auth.profile(id).subscribe(
        user => {
          this.details = user
        },
        err => {
          console.error(err)
        }
      )
  })
}

Answer 1

req.user 上面是由授权中间件填写的，它没有像你想要的那样使用 url 路径中的 id。为此，您应该使用 req.params.id