【记录撸一个博客系统】 09.登陆注册-看看laravel自带的鉴权-正式开始 unserialize(): Error at offset 0 of 81 bytes

绝地灬酷狼 2022-11-27 10:28 119阅读 0赞

经历了一堆花里胡哨的问题，终于开始看鉴权了。。。

## 默认配置 ##

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center]  
默认的配置是这样。  
![在这里插入图片描述][20200815092521652.png_pic_center]  
也就是这几个接口是session  
![在这里插入图片描述][20200815092543788.png_pic_center]  
这个是token

### 试一下 ###

![在这里插入图片描述][20200815092841737.png_pic_center]  
![在这里插入图片描述][20200815092942281.png_pic_center]  
然后这个目录多了个session  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 1]  
内容：

a:4:{s:6:"_token";s:40:"BWaXPuNaTWrvRs5TJE9fCh1UQYJmyscg3dyJ3Dlz";s:6:"_flash";a:2:{s:3:"old";a:0:{}s:3:"new";a:0:{}}s:9:"_previous";a:1:{s:3:"url";s:29:"http://blog_laravel.test:8080";}s:50:"login_web_59ba36addc2b2f9401580f014c7f58ea4e30989d";i:1;}

### 再试下JWT ###

参考：  
`https://learnku.com/laravel/t/27760`  
`https://learnku.com/articles/10885/full-use-of-jwt`

composer require tymon/jwt-auth 1.*@rc

报错了  
![在这里插入图片描述][20200815095220565.png_pic_center]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 2]  
好像。。。版本不兼容？

### 换5.6版本 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 3]  
`php artisan key:generate`

再安装，果然好了  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 4]

### 开始使用 ###

参考：`https://learnku.com/articles/10885/full-use-of-jwt`

php artisan vendor:publish --provider="Tymon\JWTAuth\Providers\LaravelServiceProvider"
    
    # 这条命令会在 .env 文件下生成一个加密密钥，如：JWT_SECRET=foobar
    php artisan jwt:secret

#### 下面的更建议看git提交（5.6分支） ####

##### User： #####

<?php
    
    namespace App;
    
    use Illuminate\Notifications\Notifiable;
    use Illuminate\Foundation\Auth\User as Authenticatable;
    use Tymon\JWTAuth\Contracts\JWTSubject;
    
    class User extends Authenticatable implements JWTSubject
    {
        use Notifiable;
    
        /**
         * The attributes that are mass assignable.
         *
         * @var array
         */
        protected $fillable = [
            'name', 'email', 'password',
        ];
    
        /**
         * The attributes that should be hidden for arrays.
         *
         * @var array
         */
        protected $hidden = [
            'password', 'remember_token',
        ];
    
        /**
         * Get the identifier that will be stored in the subject claim of the JWT.
         *
         * @return mixed
         */
        public function getJWTIdentifier()
        {
            return $this->getKey();
        }
    
        /**
         * Return a key value array, containing any custom claims to be added to the JWT.
         *
         * @return array
         */
        public function getJWTCustomClaims()
        {
            return [];
        }
    }

##### 控制器： #####

<?php
    
    namespace App\Http\Controllers;
    
    use Illuminate\Support\Facades\Auth;
    use App\Http\Controllers\Controller;
    
    class AuthController extends Controller
    {
        /**
         * Create a new AuthController instance.
         * 要求附带email和password（数据来源users表）
         *
         * @return void
         */
        public function __construct()
        {
            // 这里额外注意了：官方文档样例中只除外了『login』
            // 这样的结果是，token 只能在有效期以内进行刷新，过期无法刷新
            // 如果把 refresh 也放进去，token 即使过期但仍在刷新期以内也可刷新
            // 不过刷新一次作废
            $this->middleware('jwt.auth', ['except' => ['login']]);
            // 另外关于上面的中间件，官方文档写的是『auth:api』
            // 但是我推荐用 『jwt.auth』，效果是一样的，但是有更加丰富的报错信息返回
        }
    
        /**
         * Get a JWT via given credentials.
         *
         * @return \Illuminate\Http\JsonResponse
         */
        public function login()
        {
            $credentials = request(['email', 'password']);
    
            if (! $token = auth('api')->attempt($credentials)) {
                return response()->json(['error' => 'Unauthorized'], 401);
            }
    
            return $this->respondWithToken($token);
        }
    
        /**
         * Get the authenticated User.
         *
         * @return \Illuminate\Http\JsonResponse
         */
        public function me()
        {
            return response()->json(auth('api')->user());
        }
    
        /**
         * Log the user out (Invalidate the token).
         *
         * @return \Illuminate\Http\JsonResponse
         */
        public function logout()
        {
            auth('api')->logout();
    
            return response()->json(['message' => 'Successfully logged out']);
        }
    
        /**
         * Refresh a token.
         * 刷新token，如果开启黑名单，以前的token便会失效。
         * 值得注意的是用上面的getToken再获取一次Token并不算做刷新，两次获得的Token是并行的，即两个都可用。
         * @return \Illuminate\Http\JsonResponse
         */
        public function refresh()
        {
            return $this->respondWithToken(auth('api')->refresh());
        }
    
        /**
         * Get the token array structure.
         *
         * @param  string $token
         *
         * @return \Illuminate\Http\JsonResponse
         */
        protected function respondWithToken($token)
        {
            return response()->json([
                'access_token' => $token,
                'token_type' => 'bearer',
                'expires_in' => auth('api')->factory()->getTTL() * 60
            ]);
        }
    }

##### 路由： #####

Route::group([
        'prefix' => 'auth'
    ], function ($router) {
    
        Route::post('login', 'AuthController@login');
        Route::post('logout', 'AuthController@logout');
        Route::post('refresh', 'AuthController@refresh');
        Route::post('me', 'AuthController@me');
    
    });

##### 配置： #####

config/app.php

'aliases' => [
            ...
            // 添加以下两行
            'JWTAuth' => 'Tymon\JWTAuth\Facades\JWTAuth',
            'JWTFactory' => 'Tymon\JWTAuth\Facades\JWTFactory',
    ],

config/auth.php

'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],
    
        'api' => [
            'driver' => 'jwt',        // 原来是 token 改成jwt
            'provider' => 'users',
        ],
    ],

### 开始实践 ###

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 5]  
结果我怎么请求都是404.。。  
然后一查路由  
![在这里插入图片描述][20200815113445189.png_pic_center]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 6]  
OK

下一篇讲讲JWT的原理

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center]: /images/20221124/b0a36d87332d49a590e2f5a319080e27.png
[20200815092521652.png_pic_center]: /images/20221124/c5fe3e62ef114fcdb82001372e2019ae.png
[20200815092543788.png_pic_center]: /images/20221124/f463c2dd33334b09adb6ea99c37e5083.png
[20200815092841737.png_pic_center]: /images/20221124/ac65568a9a5046f0bb204c54469711b9.png
[20200815092942281.png_pic_center]: /images/20221124/2b0df40d53ca45c3805de089e8e256bc.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20221124/4ff99c0af8e645788997adb390fd6828.png
[20200815095220565.png_pic_center]: /images/20221124/717d9fa543b14bb3a794c591fa64ced3.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 2]: /images/20221124/3dcbe7b9931548468c7d42cbff399f95.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 3]: /images/20221124/1904d25eddaf4e9a8af711fc5abf3379.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 4]: /images/20221124/b0b556a1c11a4cf793744607ed309081.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 5]: /images/20221124/23389f7a8afb44a3bdbdc32d8667b9c3.png
[20200815113445189.png_pic_center]: /images/20221124/ef7cb8af1e704ccbba66979d4348b6c1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2hhcHB5X3RlZW1v_size_16_color_FFFFFF_t_70_pic_center 6]: /images/20221124/8227bac5f1864c00881afac9270b1db9.png