Adonis框架中使用Access Token登录后，登出接口无法获取Token的问题

我在Adonis框架中实现了基于Access Token的注册与登录功能，但调用登出API接口时，无法获取到Access Token。我尝试了以下几种方式：

async logout({ auth }: HttpContextContract) {
  const apiAuth1 = auth.token                      // undefined
  const apiAuth2 = auth.use('api').token           // undefined
  const apiAuth3 = await auth.use('api').getAuth() // auth.use(...).getAuth is not a function
}

我做了测试验证，确认用户已正确认证，但就是拿不到token：

测试代码：

async logout({ auth }: HttpContextContract) {
    const check = await auth.check('api')
    console.log('check: ', check, typeof check)

    const user = auth.user
    console.log('user: ', JSON.stringify(user, null, 2))

    const apiAuth = auth.use('api')
    // Debug the entire apiAuth object
    console.log('apiAuth:', JSON.stringify(apiAuth, null, 2))
}

测试输出：

check:  true boolean
user:  {
  "id": 27,
  "fullName": "John Doe",
  "email": "johndoe@test.com",
  "createdAt": "2024-06-03T20:12:35.000+00:00",
  "updatedAt": "2024-06-03T20:12:35.000+00:00"
}
apiAuth: {
  "driverName": "access_tokens",
  "authenticationAttempted": true,
  "isAuthenticated": true,
  "user": {
    "id": 27,
    "fullName": "John Doe",
    "email": "johndoe@test.com",
    "createdAt": "2024-06-03T20:12:35.000+00:00",
    "updatedAt": "2024-06-03T20:12:35.000+00:00"
  }
}

该接口已通过AuthMiddleware保护，中间件代码如下：

import type { HttpContext } from '@adonisjs/core/http'
import type { NextFn } from '@adonisjs/core/types/http'
import type { Authenticators } from '@adonisjs/auth/types'

/**
 * Auth middleware is used authenticate HTTP requests and deny
 * access to unauthenticated users.
 */
export default class AuthMiddleware {
  async handle(
    ctx: HttpContext,
    next: NextFn,
    options: {
      guards?: (keyof Authenticators)[]
    } = {}
  ) {
    const res = await ctx.auth.authenticateUsing(options.guards)
    return next()
  }
}

解决方法 #

1. 直接调用revoke方法完成登出
   AdonisJS的access token guard内置了revoke方法，无需手动获取token即可失效当前认证的token，这是框架推荐的标准登出方式：

async logout({ auth }: HttpContextContract) {
  await auth.use('api').revoke()
  return {
    message: '登出成功',
    revoked: true
  }
}

2. 手动获取请求中的token
   如果确实需要获取token字符串，可通过两种方式：

• 从请求头的Authorization字段提取：

async logout({ request }: HttpContextContract) {
  const token = request.header('Authorization')?.replace('Bearer ', '')
  // 后续处理逻辑
}

• 直接访问guard的token属性（注意：该属性为非枚举属性，JSON.stringify无法显示，但代码中可正常访问）：

async logout({ auth }: HttpContextContract) {
  const guardToken = auth.use('api').token
  if (guardToken) {
    await guardToken.delete() // 手动删除token
  }
}

内容的提问来源于stack exchange，提问作者guyaloni