شرح JWT Authentication: كيف يعمل وكيف تستخدمه في Node.js

xxxxx.yyyyy.zzzzz
│     │     │
│     │     └─ Signature
│     └─────── Payload (بيانات)
└───────────── Header (معلومات)

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub": "123",
  "email": "[email protected]",
  "role": "user",
  "iat": 1735603200,
  "exp": 1735606800
}

HMACSHA256(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  SECRET_KEY
)

npm install jsonwebtoken bcrypt zod
npm install -D @types/jsonwebtoken @types/bcrypt

// lib/auth.js
import jwt from "jsonwebtoken";

const SECRET = process.env.JWT_SECRET;
if (!SECRET) throw new Error("JWT_SECRET missing");

export function signToken(payload, expiresIn = "15m") {
  return jwt.sign(payload, SECRET, { expiresIn });
}

export function verifyToken(token) {
  try {
    return jwt.verify(token, SECRET);
  } catch {
    return null;
  }
}

// routes/auth.js
import express from "express";
import bcrypt from "bcrypt";
import { z } from "zod";
import { signToken } from "../lib/auth.js";
import { db } from "../db.js";

const router = express.Router();

const LoginSchema = z.object({
  email: z.string().email(),
  password: z.string().min(6),
});

router.post("/login", async (req, res) => {
  const parsed = LoginSchema.safeParse(req.body);
  if (!parsed.success) return res.status(400).json({ error: "Invalid" });

  const { email, password } = parsed.data;
  const user = await db.users.findOne({ email });
  if (!user) return res.status(401).json({ error: "خطأ في البيانات" });

  const ok = await bcrypt.compare(password, user.password);
  if (!ok) return res.status(401).json({ error: "خطأ في البيانات" });

  const accessToken = signToken({ sub: user.id, role: user.role });
  res.json({ accessToken, user: { id: user.id, email: user.email } });
});

// middleware/auth.js
import { verifyToken } from "../lib/auth.js";

export function requireAuth(req, res, next) {
  const header = req.headers.authorization;
  if (!header?.startsWith("Bearer ")) {
    return res.status(401).json({ error: "مصادقة مطلوبة" });
  }
  const token = header.slice(7);
  const payload = verifyToken(token);
  if (!payload) return res.status(401).json({ error: "توكن غير صالح" });

  req.user = payload;
  next();
}

export function requireRole(role) {
  return (req, res, next) => {
    if (req.user?.role !== role) {
      return res.status(403).json({ error: "ممنوع" });
    }
    next();
  };
}

import { requireAuth, requireRole } from "./middleware/auth.js";

app.get("/api/profile", requireAuth, (req, res) => {
  res.json({ userId: req.user.sub });
});

app.delete("/api/users/:id", requireAuth, requireRole("admin"), (req, res) => {
  // ...
});

// تسجيل الدخول
const { accessToken } = await fetch("/api/login", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ email, password }),
}).then(r => r.json());

localStorage.setItem("token", accessToken);

// طلب محمي
fetch("/api/profile", {
  headers: { Authorization: `Bearer ${accessToken}` },
});

router.post("/refresh", async (req, res) => {
  const { refreshToken } = req.body;
  const payload = verifyToken(refreshToken);
  if (!payload) return res.status(401).json({ error: "منتهي" });

  // تحقّق من أن الـ refresh token لم يُلغَ
  const stored = await db.refreshTokens.findOne({ token: refreshToken });
  if (!stored) return res.status(401).json({ error: "ملغى" });

  const accessToken = signToken({ sub: payload.sub, role: payload.role });
  res.json({ accessToken });
});

# أنشئ مفتاحاً عشوائياً (256 بت)
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

// ✅
const payload = verifyToken(token); // null عند الفشل
if (!payload) return res.status(401).end();