身份验证和授权¶

private String extractToken(HttpServletRequest request) {
 Enumeration<String> headerNames = request.getHeaderNames();
 while (headerNames.hasMoreElements()) {
 String header = headerNames.nextElement();
 LOGGER.info("header " + header + " " + request.getHeader(header));
 }
 return request.getHeader("authorization");
}

var request = require("superagent");
...

app.get('my-route', function (req, res) {
 authHeader = req.get("authorization");
 request
 .get('https://gateway.{region}.{mindsphere-domain}/api/identitymanagement/v3/Users?attributes=meta,name,userName,active')
 .set('Authorization', authHeader)
 .set('Accept', 'application/json')
 .then(function(data) {
 res.json({
 resources:data.body.resources
 });
 }).catch(err => {
 console.error(err.message, err.status);
 res.status(err.status).json({ message:'Failed to fetch users.'});
 });
});

...

x-xsrf-token:{XSRF-TOKEN}

let myXRSFToken = ...

fetch('/api/identitymanagement/v3/Users', {
 credentials: 'include',
 headers: {
 "Content-Type": "application/json",
 "Accept": "application/json",
 "x-xsrf-token":myXRSFToken
 }
})
...

var jwt = require('jsonwebtoken');
var path = require('path');
var includes = require('lodash/includes')

const express = require('express')
const app = express()

// Middleware for checking the scopes in the user token
app.use('/', function (req, res, next) {
 const authorizationHeader = authHeader = req.get("authorization");
 var scopes = [];

 if (authorizationHeader != null) {
 token = jwt.decode(authorizationHeader.replace("bearer ", ""), { complete:true, json:true })
 scopes = token.payload.scope;
 }

 console.log("scopes: ", scopes); // output all scopes

 if (includes(scopes, `${config.mdsp.appname}.${config.mdsp.scope}`)) {
 console.log("request with valid application token")
 next();
 } else {
 console.log("unauthorized request");
 res.status(403).send('no access!');
 }
});
...