在 Passportjs 中刷新 JWT 令牌

Posted 2023-03-08

【中文标题】在 Passportjs 中刷新 JWT 令牌

【英文标题】：Refreshing JWT token in Passportjs

【发布时间】：2019-09-19 08:12:35

【问题描述】：

我正在使用护照-openidconnect 策略，效果很好，但会话的到期时间很短 3600 秒，我认为它不会改变。

我会使用刷新令牌来获取另一个令牌 id 吗？

如果我这样做，我会在哪里添加这样的逻辑？ https://github.com/passport/express-4.x-openidconnect-example/blob/master/server.js

【参考方案1】：

会话的到期时间可以从身份验证提供者端进行配置。例如假设您使用auth0 作为您的身份验证提供程序，那么您可以在应用设置中配置token 超时（https://auth0.com/docs/tokens/guides/access-token/set-access-token-lifetime）

就refresh token而言，护照本身不支持它，由我们来实施。对于 auth0，您可以按照https://auth0.com/docs/tokens/refresh-token/current 的流程更新令牌。我粘贴了该链接中的代码：

var request = require("request");

var options =  method: 'POST',
  url: 'https://YOUR_DOMAIN/oauth/token',
  headers:  'content-type': 'application/x-www-form-urlencoded' ,
  form: 
    grant_type: 'refresh_token',
     client_id: 'YOUR_CLIENT_ID',
     client_secret: 'YOUR_CLIENT_SECRET',
     refresh_token: 'YOUR_REFRESH_TOKEN'  ;

request(options, function (error, response, body) 
  if (error) throw new Error(error);

  console.log(body);
);

或者您可以使用护照插件https://github.com/fiznool/passport-oauth2-refresh

var passport = require('passport'),
  , refresh = require('passport-oauth2-refresh')
  , FacebookStrategy = require('passport-facebook').Strategy;

var strategy = new FacebookStrategy(
  clientID: FACEBOOK_APP_ID,
  clientSecret: FACEBOOK_APP_SECRET,
  callbackURL: "http://www.example.com/auth/facebook/callback"
,
function(accessToken, refreshToken, profile, done) 
  // Make sure you store the refreshToken somewhere!
  User.findOrCreate(..., function(err, user) 
    if (err)  return done(err); 
    done(null, user);
  );
);

passport.use(strategy);
refresh.use(strategy);

var refresh = require('passport-oauth2-refresh');
refresh.requestNewAccessToken('facebook', 'some_refresh_token', function(err, accessToken, refreshToken) 
  // You have a new access token, store it in the user object,
  // or use it to make a new request.
  // `refreshToken` may or may not exist, depending on the strategy you are using.
  // You probably don't need it anyway, as according to the OAuth 2.0 spec,
  // it should be the same as the initial refresh token.

);