安全最佳实践

  // example using passport.js with jwt for authentication  const passport = require('passport');  const passportjwt = require('passport-jwt');  const jwtstrategy = passportjwt.strategy;  const extractjwt = passportjwt.extractjwt;  const user = require('../models/user');  passport.use(new jwtstrategy({      jwtfromrequest: extractjwt.fromauthheaderasbearertoken(),      secretorkey: 'your_secret_key'    },    async (jwtpayload, done) => {      try {        const user = await user.findbyid(jwtpayload.id);        if (!user) {          return done(null, false, { message: 'user not found' });        }        return done(null, user);      } catch (err) {        return done(err);      }    }  ));

// middleware/auth.jsconst jwt = require('jsonwebtoken');const config = require('../config');const User = require('../models/user');function verifyToken(req, res, next) {  const token = req.headers['authorization'];  if (!token) {    return res.status(403).json({ message: 'Token not provided' });  }  jwt.verify(token, config.secret, async (err, decoded) => {    if (err) {      return res.status(401).json({ message: 'Unauthorized' });    }    req.userId = decoded.id;    const user = await User.findById(decoded.id);    if (!user) {      return res.status(404).json({ message: 'User not found' });    }    next();  });}module.exports = verifyToken;