{"id":9419,"date":"2018-09-16T22:44:58","date_gmt":"2018-09-16T22:44:58","guid":{"rendered":"http:\/\/www.gencayyildiz.com\/blog\/?p=9419"},"modified":"2018-09-16T22:44:58","modified_gmt":"2018-09-16T22:44:58","slug":"node-js-jwt-token-kullanimi","status":"publish","type":"post","link":"https:\/\/www.gencayyildiz.com\/blog\/node-js-jwt-token-kullanimi\/","title":{"rendered":"Node.js – JWT Token Kullan\u0131m\u0131"},"content":{"rendered":"
<\/div>\n

Merhaba,<\/p>\n

Bir \u00f6nceki Node.js \u2013 JWT \u0130le Token Olu\u015fturma<\/a> ba\u015fl\u0131kl\u0131 makalemde Node.js’de token nas\u0131l olu\u015fturulur incelemi\u015ftik. Bu i\u00e7eri\u011fimizde ise olu\u015fturulan bu token ile API’a eri\u015fim i\u015flemlerinin nas\u0131l yap\u0131laca\u011f\u0131n\u0131 inceleyece\u011fiz.<\/p>\n

Her\u015feyden \u00f6nce olu\u015fturulan bir token\u0131 API’da kullanabilmek i\u00e7in bir Middleware<\/a> olu\u015fturulmas\u0131 gerekti\u011fini ifade ederek ba\u015flayal\u0131m. Bu middleware \u00fczerinden herhangi bir get ya da post iste\u011fine kar\u015f\u0131l\u0131k \u00fcretilen bir token\u0131n olup olmad\u0131\u011f\u0131 denetlenecek ve bu denetleme neticesine g\u00f6re ilgili rotalar tetiklenecektir.<\/p>\n

Token Olu\u015fturma ve Altyap\u0131 Kurulumu<\/h3>\n

\u0130lk olarak a\u015fa\u011f\u0131daki gibi token \u00fcreten mod\u00fcl\u00fcm\u00fcz\u00fc in\u015fa edelim;<\/p>\n

\r\n--- tokenRouter.js ---\r\nconst router = require("express").Router();\r\nconst jwt = require("jsonwebtoken");\r\n\r\nrouter.post("\/getToken", (request, response, next) => {\r\n    const { userName, password } = request.body;\r\n    const payLoad = {\r\n        userName,\r\n        password,\r\n        email: "gyildizmail@gmail.com"\r\n    };\r\n    const token = jwt.sign(payLoad, request.app.get("api_secret_key"), { expiresIn: 120 });\r\n    response.json({\r\n        status: true,\r\n        token\r\n    });\r\n});\r\n\r\nmodule.exports = router;\r\n<\/pre>\n
Ard\u0131ndan ana mod\u00fcl\u00fcm\u00fcz\u00fc a\u015fa\u011f\u0131daki gibi olu\u015ftural\u0131m;<\/p>\n
\r\nconst app = require("express")();\r\nconst bodyParser = require("body-parser");\r\n\r\napp.set("api_secret_key", require(".\/config").api_secret_key);\r\napp.use(bodyParser.json());\r\napp.use(bodyParser.urlencoded({ extended: true }));\r\n\r\napp.use("\/token", require(".\/routers\/tokenRouter"));\r\n\r\napp.listen(5000, () => console.log("Yay\u0131n ba\u015flad\u0131..."));\r\n<\/pre>\n
Burada global olarak tan\u0131mlanan “api_secret_key” de\u011fi\u015fkeninde kullan\u0131lan “config” mod\u00fcl\u00fcn\u00fcde a\u015fa\u011f\u0131daki gibi olu\u015ftural\u0131m;<\/p>\n
\r\nmodule.exports = {\r\n    api_secret_key: "\u00f6l\u00fcme gidelim dedinde, mazotmu yok dedik."\r\n};\r\n<\/pre>\n
Evet… Bu noktada “http:\/\/localhost:5000\/token\/getToken” adresine a\u015fa\u011f\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcnde oldu\u011fu gibi post talebi g\u00f6nderdi\u011fimiz vakit s\u0131k\u0131nt\u0131s\u0131z token de\u011ferimiz olu\u015fturulmaktad\u0131r.
\n\"Node.js<\/a><\/p>\n
\u015eimdi olu\u015fturulan bu token de\u011ferini API’ye \u00f6zel eri\u015fim i\u015flemleri i\u00e7in kullanmaya s\u0131ra geldi.<\/p>\n
\u00dcretilmi\u015f Token’\u0131n Kullan\u0131m\u0131<\/h3>\n
API’ye yap\u0131lacak taleplerde token\u0131n \u00fcretilip \u00fcretilmedi\u011fini kontrol edece\u011fimiz middleware’\u0131 olu\u015ftural\u0131m.<\/p>\n
\r\n--- verify-token.js ---\r\nconst jwt = require("jsonwebtoken");\r\n\r\nmodule.exports = (request, response, next) => {\r\n    const token = request.headers["x-access-token"] || request.body.token || request.query.token;\r\n    if (!token)\r\n        response.send("Token bulunmamaktad\u0131r.");\r\n    else {\r\n        jwt.verify(token, request.app.get("api_secret_key"), (error, decoded) => {\r\n            if (error)\r\n                response.send("Beklenmeyen bir hatayla kar\u015f\u0131la\u015f\u0131ld\u0131.");\r\n            else {\r\n                request.decode = decoded;\r\n                next();\r\n            }\r\n        });\r\n    }\r\n};\r\n<\/pre>\n
Yukar\u0131daki middleware i\u00e7erisindeki kodlar\u0131 incelerseniz e\u011fer 5. sat\u0131rda “token” de\u011fi\u015fkenine birden fazla alandan de\u011fer set edilmektedir. Bunun sebebi bizlerin \u00fcretilen tokena requestten \u00fc\u00e7 farkl\u0131 yolla eri\u015febilmemizden kaynaklanmas\u0131d\u0131r. Bu yollar;<\/p>\n
    \n
  1. Header<\/strong>
    \nrequest.headers[“x-access-token”]<\/em>\n<\/li>\n
  2. Post Body<\/strong>
    \nrequest.body.token<\/em>\n<\/li>\n
  3. Get Query<\/strong>
    \nrequest.query.token<\/em>\n<\/li>\n<\/ol>\n
    Dolay\u0131s\u0131yla \u00f6nceden \u00fcretilmi\u015f token, request taraf\u0131ndan bu \u00fc\u00e7 farkl\u0131 yolla eri\u015filebilir olaca\u011f\u0131ndan dolay\u0131 ilgili ifadede t\u00fcm alanlar denetlenmekte ve hangisinde veri varsa ilgili de\u011fi\u015fken taraf\u0131ndan elde edilmektedir.<\/p>\n
    Ayr\u0131ca kodun devam\u0131nda “jsonwebtoken” mod\u00fcl\u00fcn\u00fcn “verify” fonksiyonu arac\u0131l\u0131\u011f\u0131yla elde edilen token, secret key ile birlikte denetlenmekte ve 3. parametrede yaz\u0131lan callback fonksiyonunun “decoded” parametresi arac\u0131l\u0131\u011f\u0131yla \u00e7\u00f6z\u00fcmlenen token requestin “decode” \u00f6zelli\u011fine atanmaktad\u0131r ve next fonksiyonu ile talepte bulunulan routea y\u00f6nlendirme sa\u011flanmaktad\u0131r. Bu \u00e7\u00f6z\u00fcm neticesinde “decoded” parametresinden asl\u0131nda token olu\u015fum s\u00fcrecinde belli ba\u015fl\u0131 verilerimizi temsil eden “Payload” nesnesi elde edilecektir.<\/p>\n
    \u015eimdi olu\u015fturdu\u011fumuz bu middleware’\u0131 ana mod\u00fcl\u00fcm\u00fczde “use” metodu ile uygulamaya katmal\u0131y\u0131z.<\/p>\n
    \r\nconst app = require("express")();\r\nconst bodyParser = require("body-parser");\r\n\r\n\r\napp.set("api_secret_key", require(".\/config").api_secret_key);\r\napp.use(bodyParser.json());\r\napp.use(bodyParser.urlencoded({ extended: true }));\r\n\r\napp.use("\/employee", require(".\/middleWares\/verify-token"));\r\napp.use("\/employee", require(".\/routers\/employeeRouter"));\r\napp.use("\/token", require(".\/routers\/tokenRouter"));\r\n\r\napp.listen(5000, () => console.log("Yay\u0131n ba\u015flad\u0131..."));\r\n<\/pre>\n
    Yukar\u0131daki kod blo\u011funa dikkat ederseniz e\u011fer yazm\u0131\u015f oldu\u011fumuz “verify-token” isimli middleware “\/employee” de\u011feri alt\u0131ndaki routelar i\u00e7in token kontrol mekanizmas\u0131 sa\u011flayacakt\u0131r. Dolay\u0131s\u0131yla “employeeRouter” mod\u00fcl\u00fcm\u00fcz\u00fcde a\u015fa\u011f\u0131daki gibi in\u015fa edelim;<\/p>\n
    \r\n--- employeeRouter.js ---\r\nconst router = require("express").Router();\r\n\r\nrouter.get("\/get", (request, response, next) => {\r\n    response.send("...");\r\n});\r\n\r\nrouter.post("\/post", (request, response, next) => {\r\n    response.send("...");\r\n});\r\nmodule.exports = router;\r\n<\/pre>\n
    Test Edelim<\/h3>\n
    Evet… Art\u0131k t\u00fcm \u00e7al\u0131\u015fmalar\u0131m\u0131z bitmi\u015f bulunmaktad\u0131r. \u015eimdi Postman uygulamas\u0131yla testlerimizi ger\u00e7ekle\u015fitirelim;
    \n    \"Node.js<\/a>
    \nG\u00f6rd\u00fc\u011f\u00fcn\u00fcz gibi direkt olarak “\/employee\/get” adresine talepte bulundu\u011fumuz zaman token ile ilgili uyar\u0131yla kar\u015f\u0131la\u015fmaktay\u0131z. \u015eimdi \u00fc\u00e7 farkl\u0131 y\u00f6ntemle token\u0131m\u0131z\u0131 g\u00f6nderelim.(Tabi ilk olarak “http:\/\/localhost:5000\/token\/getToken” adresinden token \u00fcretmeyi unutmuyoruz)<\/span><\/p>\n