Node.js：如何在 multer 中使用令牌？答案

【问题标题】：Node.js : How to use token with multer?Node.js：如何在 multer 中使用令牌？
【发布时间】：2022-01-02 14:16:31
【问题描述】：

我想运行两台相同的服务器。我想将图像从一个上传到另一个。这些来源运作良好，但我觉得为了安全起见需要验证令牌。

我将使用 settings.js 的函数createUploadToOther 将图像发送到其他服务器。我通常写一个路由器，比如 router.post('/fromOther', verifyToken, function (req, res) {

但在这种情况下，我不知道该把 verifyToken 放在哪里。你能告诉我在这种情况下如何使用带有 multer header(?) 的令牌吗？

file.js

let express = require("express");
let router = express.Router();


let path = require('path');
let uploadDir = 'static' 
let fs = require('fs');
const verifyToken = require('../libs/verifyToken')

const axios = require('axios')
const FormData = require('form-data')

let multer = require('multer');

let storageForSentFile = multer.diskStorage({
  destination: function (req, file, callback) { 
    callback(null, uploadDir);
  },
  filename: function (req, file, callback) {  
    callback(null, file.originalname);
  }
})
let uploadForSentFile = multer({ storage: storageForSentFile })



router.post('/fromOther', uploadForSentFile.single('logo'), function (req, res) {
  
  console.log("------file upload -------")
  console.log(req.file)
  res.json(req.file)

});

router.post('/toOther', uploadForSentFile.single('logo') , async function (req, res) {
  let formData = new FormData()

  formData.append('logo', fs.createReadStream(req.file.path), { knownLength: req.file.size })
  
  const headers = {
      ...formData.getHeaders(),
      "Content-Length": formData.getLengthSync()
  };
  
  try {
    let result = await axios.post(
      new URL('/file/fromOther', req.body.serverURL).href,
      formData,
      {headers }
    )
    
    res.status(200).json(result.data)
  } catch (err) {
    console.log('file/toOther err', err)
  }
})

../libs/verifyToken.js

let jwt = require("jsonwebtoken");
const dotenv = require("dotenv");

function verifyToken(req, res, next) {
  console.log("req.headers1 : ", req.headers);
  let token = req.headers["authorization"];

  if (!token)
    return res.json({ status: 409, message: 'No authorization' })


  jwt.verify(token, process.env.aSecretKey, function (err, decoded) {
    if (err)
      return res
        .status(500)
        .send({ auth: false, message: "Check your ID and password" });
    console.log("decoded", decoded);
    req.account = decoded.account;
    req.idx = decoded.idx;
    next();
  });
}

module.exports = verifyToken;

settings.js

import axios from 'axios'
import { headers } from '../config/env'

export function createUploadToOther(data) {
  return axios.post('/file/toOther', data, { headers })
}

【问题讨论】：

标签： node.js vue.js

【解决方案1】：

路由器中的函数 verifyToken('/fromOther') 只检查 req.headers["authorization"]，所以我只是将函数 verifyToken 作为参数添加到两个路由器（实际上不需要将 verifyToken 添加到路由器（'/toOther'）但想使其更安全）并将密钥"authorization" 和req.headers.authorization 的值添加到路由器（'/toOther'）。然后它运行良好，但我不知道这是否足够安全。

//(...)
router.post('/fromOther', verifyToken, uploadForSentFile.single('logo'), function (req, res) {
  
  console.log("------file upload -------")
  console.log(req.file)
  res.json(req.file)

});

router.post('/toOther', verifyToken, uploadForSentFile.single('logo') , async function (req, res) {
  let formData = new FormData()

  formData.append('logo', fs.createReadStream(req.file.path), { knownLength: req.file.size })
  
  const headers = {
      ...formData.getHeaders(),
      "Content-Length": formData.getLengthSync(),
      "authorization": req.headers.authorization
  };
  
  try {
    let result = await axios.post(
      new URL('/file/fromOther', req.body.serverURL).href,
      formData,
      {headers }
    )
    
    res.status(200).json(result.data)
  } catch (err) {
    console.log('file/toOther err', err)
  }
})
//(...)

【讨论】：