怎么调试nodejs restful API 以及API的Authorization
最近Nodejs，python越来越火了，同时也越来越多的人在用node写服务，可是怎么去调试服务呢？以及当你一个服务发布出去，怎么保证其安全性呢？
环境：linux unbuntu
语言：nodejs
工具:npm,mongodb,HttpIE
昨天写API的时候遇到了一个苦恼，就是我怎么去调试一个Api，当然有人会说客户端调用一下，然后debug模式就可以跟踪了，可是我昨天没有客户端，怎么办呢？后来找到了一个非常好的工具HttpIE,怎么安装可以参考 https://httpie.org/doc#linux，大家可能根据自己的开发环境去安装
example:
# Debian, Ubuntu, etc. apt-get install httpie # Fedora, CentOS, RHEL, … yum install httpie # Arch Linux pacman -S httpie
不过万事都有不顺的时候，我在安装的时候遇到了一个问题
william@ubuntu:~$ sudo apt-get install httpie [sudo] password for william: Reading package lists... Done Building dependency tree Reading state information... Done You might want to run 'apt-get -f install' to correct these: The following packages have unmet dependencies: cpp-5 : Depends: gcc-5-base (= 5.4.0-6ubuntu1~16.04.2) but 5.4.0-6ubuntu1~16.04.4 is to be installed gcc-5 : Depends: cpp-5 (= 5.4.0-6ubuntu1~16.04.4) but 5.4.0-6ubuntu1~16.04.2 is to be installed google-chrome-stable : Depends: libappindicator1 but it is not going to be installed httpie : Depends: python-pygments but it is not going to be installed Depends: python-requests but it is not going to be installed libstdc++-5-dev : Depends: libstdc++6 (>= 5.4.0-6ubuntu1~16.04.4) but 5.4.0-6ubuntu1~16.04.2 is to be installed libstdc++6 : Depends: gcc-5-base (= 5.4.0-6ubuntu1~16.04.2) but 5.4.0-6ubuntu1~16.04.4 is to be installed E: Unmet dependencies. Try 'apt-get -f install' with no packages (or specify a solution). william@ubuntu:~$ sudo apt-get -f install Reading package lists... Done Building dependency tree Reading state information... Done Correcting dependencies... Done The following additional packages will be installed: cpp-5 libappindicator1 libindicator7 libstdc++6 Suggested packages: gcc-5-locales The following NEW packages will be installed: libappindicator1 libindicator7 The following packages will be upgraded: cpp-5 libstdc++6 2 upgraded, 2 newly installed, 0 to remove and 441 not upgraded. 17 not fully installed or removed. Need to get 0 B/8,088 kB of archives. After this operation, 161 kB of additional disk space will be used. Do you want to continue? [Y/n] Y (Reading database ... 214296 files and directories currently installed.) Preparing to unpack .../cpp-5_5.4.0-6ubuntu1~16.04.4_amd64.deb ... Unpacking cpp-5 (5.4.0-6ubuntu1~16.04.4) over (5.4.0-6ubuntu1~16.04.2) ... dpkg-deb (subprocess): decompressing archive member: lzma error: compressed data is corrupt dpkg-deb: error: subprocess <decompress> returned error exit status 2 dpkg: error processing archive /var/cache/apt/archives/cpp-5_5.4.0-6ubuntu1~16.04.4_amd64.deb (--unpack): cannot copy extracted data for './usr/lib/gcc/x86_64-linux-gnu/5/cc1' to '/usr/lib/gcc/x86_64-linux-gnu/5/cc1.dpkg-new': unexpected end of file or stream Errors were encountered while processing: /var/cache/apt/archives/cpp-5_5.4.0-6ubuntu1~16.04.4_amd64.deb E: Sub-process /usr/bin/dpkg returned an error code (1)
报错了，原因是需要清除掉缓存
william@ubuntu:~$ sudo apt-get clean
然后重复上面的操作（蓝色字体）的命令就可以完成了
怎么用HttpIE去调试API呢，比如我需要调试添加一条article记录怎么办呢？ http://localhost:1337/api/articles，
$ http POST http://localhost:1337/api/articles title=TestArticle author='John Doe' description='lorem ipsum dolar sit amet' images:='[{"kind":"thumbnail", "url":"http://habrahabr.ru/images/write-topic.png"}, {"kind":"detail", "url":"http://habrahabr.ru/images/write-topic.png"}]'
看截图：
然后进入到了virtual studio code里面的断点：
怎么保证其安全性呢？ 我用的是oauth2orize， https://www.npmjs.com/package/oauth2orize
在调用的时候加入：
router.post('/', passport.authenticate('bearer', { session: false }), function(req, res) {
然后调用的时候，需要加入token:
william@ubuntu:~$ http POST http://localhost:1337/api/articles title=NewArticle author='John Doe' description='Lorem ipsum dolar sit amet' images:='[{"kind":"thumbnail", "url":"http://habrahabr.ru/images/write-topic.png"}, {"kind":"detail", "url":"http://habrahabr.ru/images/write-topic.png"}]' Authorization:'Bearer put your token here'
passport 与oauth2orize 联合使用，其中有2个重要的概念AccessToken 和 RefreshToken, 为什么有了AccessToken还需要RefreshToken呢？因为token都会过期，需要运用RefreshToken去刷新AccessToken
var oauth2orize = require('oauth2orize'); var passport = require('passport'); var crypto = require('crypto'); var libs = process.cwd() + '/libs/'; var config = require(libs + 'config'); var log = require(libs + 'log')(module); var db = require(libs + 'db/mongoose'); var User = require(libs + 'model/user'); var AccessToken = require(libs + 'model/accessToken'); var RefreshToken = require(libs + 'model/refreshToken'); // create OAuth 2.0 server var aserver = oauth2orize.createServer(); // Generic error handler var errFn = function (cb, err) { if (err) { return cb(err); } }; // Destroys any old tokens and generates a new access and refresh token var generateTokens = function (data, done) { // curries in `done` callback so we don't need to pass it var errorHandler = errFn.bind(undefined, done), refreshToken, refreshTokenValue, token, tokenValue; RefreshToken.remove(data, errorHandler); AccessToken.remove(data, errorHandler); tokenValue = crypto.randomBytes(32).toString('hex'); refreshTokenValue = crypto.randomBytes(32).toString('hex'); data.token = tokenValue; token = new AccessToken(data); data.token = refreshTokenValue; refreshToken = new RefreshToken(data); refreshToken.save(errorHandler); token.save(function (err) { if (err) { log.error(err); return done(err); } done(null, tokenValue, refreshTokenValue, { 'expires_in': config.get('security:tokenLife') }); }); }; // Exchange username & password for access token. aserver.exchange(oauth2orize.exchange.password(function(client, username, password, scope, done) { User.findOne({ username: username }, function(err, user) { if (err) { return done(err); } if (!user || !user.checkPassword(password)) { return done(null, false); } var model = { userId: user.userId, clientId: client.clientId }; generateTokens(model, done); }); })); // Exchange refreshToken for access token. aserver.exchange(oauth2orize.exchange.refreshToken(function(client, refreshToken, scope, done) { RefreshToken.findOne({ token: refreshToken, clientId: client.clientId }, function(err, token) { if (err) { return done(err); } if (!token) { return done(null, false); } User.findById(token.userId, function(err, user) { if (err) { return done(err); } if (!user) { return done(null, false); } var model = { userId: user.userId, clientId: client.clientId }; generateTokens(model, done); }); }); })); // token endpoint // // `token` middleware handles client requests to exchange authorization grants // for access tokens. Based on the grant type being exchanged, the above // exchange middleware will be invoked to handle the request. Clients must // authenticate when making requests to this endpoint. exports.token = [ passport.authenticate(['basic', 'oauth2-client-password'], { session: false }), aserver.token(), aserver.errorHandler() ];
创建AccessToken和RefreshToken
http POST http://localhost:1337/api/oauth/token grant_type=password client_id=android client_secret=SomeRandomCharsAndNumbers username=myapi password=abc1234 http POST http://localhost:1337/api/oauth/token grant_type=refresh_token client_id=android client_secret=SomeRandomCharsAndNumbers refresh_token=[TOKEN]
