javascript - 从浏览器发送 http 请求时缺少授权 header

Question

我在 nodejs 中有一个带有 jwt 授权的应用程序，当我从 posman 发送一个 get 时，找到了身份验证 header ，但是当我从浏览器发送它时，缺少授权 header 。
这是 Node 代码，我试图在 verifyToken 方法中获取授权 header ，但不存在:

'use strict';

var SwaggerExpress = require('swagger-express-mw');
var app = require('express')();
module.exports = app; // for testing
var _ = require('lodash');
var jwt = require('jsonwebtoken'); // used to create, sign, and verify tokens

var config = {
  appRoot: __dirname // required config
};

app.set('superSecret', config.secret); // secret variable
// bootstrap database connection and save it in express context
app.set("models", require("./api/model"));
var a = app.get("models").Role;

var repositoryFactory = require("./api/repository/RepositoryFactory").init(app);

var verifyToken = function (req, res, next) {
  // verify token and read user from DB
  // var token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwiTm9tYnJlVXN1YXJpbyI6ImQiLCJQYXNzd29yZCI6IiQyYSQxMCRYS3BJM2ZDRVFoSzVKUFBQWEdIVVZPbUVPQTZsRVRoZDRtWHl4a0tDeGtUcEhvY0U0UTNILiIsImNyZWF0ZWRBdCI6IjIwMTYtMDktMDVUMTg6Mjk6MTYuMDAwWiIsInVwZGF0ZWRBdCI6IjIwMTYtMDktMDVUMTg6Mjk6MTYuMDAwWiIsInByb2Zlc2lvbmFsSWQiOm51bGwsInByb2Zlc2lvbmFsIjpudWxsLCJpYXQiOjE0NzMyNTczMjcsImV4cCI6MTQ3MzI5MzMyN30.CKB-GiuvwJsDAVnKsWb1FktI9tJY57lSgPRVEfW3pts';
  var token = req.headers.authorization;
  jwt.verify(token, 'shhhhh', function (err, decoded) {
    if (err) {
      res.status(403).json({ success: false, message: 'Failed to authenticate token.' });
    } else {
      // if everything is good, save to request for use in other routes
      req.user = decoded;
      next();
    }
  });
};

SwaggerExpress.create(config, function (err, swaggerExpress) {
  if (err) { throw err; }

  app.use(function (req, res, next) {
    res.header("Access-Control-Allow-Origin", "*");
    res.header("Access-Control-Allow-Headers", "X-CSRF-Token, X-Requested-With, Origin, client-security-token, X-Requested-With, Content-Type, Accept, Authorization");
    res.setHeader('Content-Type', 'application/json');
    res.setHeader('Access-Control-Allow-Credentials', true);
    next();
  });

  app.use(verifyToken);

  // install middleware
  swaggerExpress.register(app);



  var port = process.env.PORT || 10010;
  app.listen(port);
});

我不知道我缺少什么配置。

Answer 1

问题是我试图从 OPTIONS 方法获取授权 token ，这个方法是在实际的 get、port、put 等之前发送的，什么时候是 CORS 请求。所以我试图从中获取授权 header ，但它不存在并且该方法失败。
解决方案是在验证 token 方法中设置如下验证:

if (req.method !== OPTIONS){
}