如何将 JWT 用于使用 Node.js 编写的代理服务器?

这绝对是一个新手问题&我是 Node.js 初学者.

This is absolutely a newbie question & I am Node.js beginner.

我不确定，这是问这个问题的正确地方.但我可能需要这个大型社区的想法.那么让我解释一下我想要做什么.

I am not sure, this is right place to ask this question. But I may need idea from this large community. So let me explain what I am trying to do.

服务器配置:

1. Node.js - 4.0.0
2. Hapi.js - 10.0.0
3. Redis

场景:

我正在使用 hapijs 在 nodejs 中编写代理服务器.我的后端是基于 ATG 的电子商务网站，我的 api 将被网络浏览器、移动应用程序等使用.

I am writing a proxy server in nodejs using hapijs. My Backend is ATG based e-commerce website and my api's are going to be consumed by web browser, mobile app etc..

我们计划不将 ATG 发送的 cookie 发送到浏览器和移动设备.

We planned not to send the cookies sent by ATG to both browser and mobile.

为了维护来自 ATG 的会话和 cookie，我们就是这样做的.

So to maintain sessions and cookies from ATG,this is how we done POC.

首先我们计划没有考虑存储从 ATG 返回的匿名用户 cookie.所以我们做了两个 POC.

First We planned without considering storing the anonymous user cookies returned from ATG. So we have done two POC's.

(我们中的许多人都知道，匿名 cookie 是什么，无论如何让我解释一下，如果我说一个词——访客结账.有很多方法可以实现这一点.但我的商务后端是这样实现的，当我们访问网站，您将商品添加到购物车并在不登录的情况下结帐该商品，对吗?每当我们添加商品时，后台会发生这种情况，它们仅存储在您的浏览器 cookie 中，而不存储在持久数据库中，无论如何用户想要登录/注册从浏览器检索cookie并存储在数据库中的帐户(基本上匿名购物车被转移到登录用户.))

(Many of us know, what anonymous cookie is,any way let me explain that, if I put that one word -- Guest Checkout. There are many ways to accomplish this. But my Commerce Backend is implemented like this, When we go to website, you add items to cart and checkout that items without logging in right ? This what happens on background whenever we add the items they are only stored in your browser cookie,it not stored in persistent database, in any case user wants to login/signup to the account that cookie is retrieved from the browser and stored in database (basically that anonymous cart is transferred to logged in user.))

POC-1(不考虑客人结账):

POC-1 (Not Considering Guest Checkout):

1. 要访问我的api，用户必须登录，登录成功后，我们生成一个rand-token并将其存储在Redis db中，与从ATG发送的用于登录用户的cookie相关联并设置ttl 1 小时，然后将该令牌返回给客户端

1. To access my api, user must be logged-in, after the successful login, We generate a rand-token and store it in Redis db associated with the cookies sent from the ATG for logged-in user and set ttl for 1 hour and return that token to the client

现在每当他们调用任何 api 方法时，他们应该在授权标头中发送令牌，我将检查令牌有效性并再次扩展 ttl 1 小时并检索与该令牌关联的 cookie，设置ATG 请求选项中的 cookie 并发出请求.

Now whenever they invoke any of api methods, they should send the token in the authorization header, I will check for token validity and expand the ttl once again for 1 hour and retrieve the cookies associated with that token, set that cookies in ATG request options and make a request.

3.退出时，我会清除cookie并删除令牌.

3.On logout, I will clear the cookie and delete the token.

通过在 jwt 负载中生成带有用户登录信息的 JWT 令牌，我已成功实现了针对此场景的 JWT.使用 hapi-jwt-auth2.

I have successfully implemented JWT fot this scenario, by generating a JWT token with user logged-in information in jwt payload. Used hapi-jwt-auth2.

POC-2(维护访客 Cookie)，

POC-2 (With Maintaining Guest Cookies),

1. 我的 API 将具有端点/auth/generatesession，它反过来将返回一个 64 字节的随机令牌(我们为此使用 rand-token npm 模块)，该令牌将在 24 小时后过期.

1. My API Will have endpoint /auth/generatesession, which in turn will return a 64 byte random token (we are using rand-token npm module for that) which will expire in 24 hours.

所有方法都需要将访问令牌在授权标头中传回给我，我会将令牌 ttl 延长至 24 小时.

All the methods needs that access token passed back to me in authorization header and I will extend that token ttl to 24 hours.

现在他们可以调用任何 api 方法，例如 addtocart 或其他方法，即使在将商品添加到购物车后，突然他们想登录或我可以使用他们的访客会话 cookie 并在成功登录后将该购物车传输到持久数据库.

Now they can invoke any api methods, like addtocart or something, even after adding items to cart , suddenly they want to login or something I can use their guest session cookie and transfer that cart to persistent database after successful login.

问题:

1. 对于第二种情况，我应该使用 JWT 吗?如果是这样，
2. 如何为第二个场景实施 JWT?(因为，不知道用户是谁?)
3. 有人认为编写这样的代理服务器是个好主意吗?
4. 如何使用 ATG session Expiry 简化此令牌的会话到期时间?
5. 有没有人像这样使用 Node.js?它是如何扩展的?
6. 如果有人愿意告诉我如何编写这个代理服务器，这对我很有帮助.

我很抱歉，如果这是一个太长的问题，这只是我解释事情的方式.

I Apologize, if this is too long question, just my way of explaining things.

提前致谢.