41 lines
1.4 KiB
Lua
41 lines
1.4 KiB
Lua
local jwt = require "resty.jwt"
|
||
local validators = require "resty.jwt-validators"
|
||
local conf = require("config")
|
||
|
||
--获取用户认证数据信息
|
||
local auth_header = ngx.var.http_Authorization
|
||
|
||
--如果请求头中没有令牌，则直接返回401
|
||
if auth_header == nil or auth_header == "" then
|
||
ngx.log(ngx.WARN, "没有找到令牌数据")
|
||
ngx.status = ngx.HTTP_UNAUTHORIZED
|
||
ngx.exit(ngx.HTTP_UNAUTHORIZED)
|
||
end
|
||
|
||
--查找令牌中的Bearer前缀字符，并进行截取 todo 使用jsonscheme进行匹配
|
||
local _, _, token = string.find(auth_header, "Bearer%s+(.+)")
|
||
--如果没有Bearer，则表示令牌格式不正确
|
||
if token == nil then
|
||
ngx.log(ngx.WARN, "令牌格式不正确")
|
||
ngx.status = ngx.HTTP_UNAUTHORIZED
|
||
ngx.exit(ngx.HTTP_UNAUTHORIZED)
|
||
end
|
||
|
||
--校验令牌
|
||
local jwt_obj = jwt:verify(conf.secret_key, auth_header)
|
||
--如果校验结果中的verified==false，则表示令牌无效
|
||
if jwt_obj.verified == false then
|
||
ngx.log(ngx.WARN, "Invalid token: ".. jwt_obj.reason)
|
||
ngx.status = ngx.HTTP_UNAUTHORIZED
|
||
ngx.exit(ngx.HTTP_UNAUTHORIZED)
|
||
end
|
||
|
||
--判断token是否超时 --令牌已过期
|
||
if jwt_obj.payload.exp and os.time() > jwt_obj.payload.exp then
|
||
ngx.log(ngx.WARN, "token timeout ".. jwt_obj.reason)
|
||
ngx.status = ngx.HTTP_UNAUTHORIZED
|
||
ngx.exit(ngx.HTTP_UNAUTHORIZED)
|
||
end
|
||
|
||
--全部校验完成后，说明令牌有效，返回令牌数据
|
||
ngx.log(ngx.INFO, "令牌校验通过 JWT: " .. cjson.encode(jwt_obj)) |