我打算在我的Express.js后端API上创建一个私有范围的端点,以检查一些自定义权限。我在auth0中使用RBAC (基于角色的访问控制)和‘快递-OAuth2-JWT-承载’包(https://www.npmjs.com/package/express-oauth2-jwt-bearer)。当我试图访问那个端点时,我经常会遇到一个不足的作用域错误。
明示代码,
const express = require('express');
const app = express();
const { auth, requiredScopes } = require('express-oauth2-jwt-bearer');
const checkJwt = auth();
const requiredScopes = requiredScopes("getAll:student", { customScopeKey: "permissions" });
app.get(
"/student/getAll",
checkJwt,
requiredScopes,
res.json({
message: 'Here is the all Student detail list'
});
);解码JSON令牌详细信息,1:https://i.stack.imgur.com/EtZfU.jpg
{
"iss": "https://*************.us.auth0.com/",
"sub": "auth0|******************",
"aud": [
"http://*************",
"https://*************.us.auth0.com/userinfo"
],
"iat": 1657083984,
"exp": 1657170384,
"azp": "***********************",
"scope": "openid profile email",
"permissions": [
"delete:student",
"getAll:student",
"search:student",
"update:student"
]
}但是,如果我使用const requiredScopes = requiredScopes("openid profile email", { customScopeKey: "permissions" });而不是const requiredScopes = requiredScopes("getAll:student", { customScopeKey: "permissions" });,它就能工作。我认为问题在于权限不是检查自定义范围键,而是使用默认范围键。有人能帮我修好吗?
发布于 2022-10-13 19:55:01
我也有同样的问题-- requiredScopes好像坏了。我所做的是使用同一个库中的claimCheck:
const checkClaims = claimCheck(claims => {
return claims.permissions.includes('your:permission')
});https://stackoverflow.com/questions/72879110
复制相似问题