NestJS中JwtStrategy验证Cognito访问令牌失败求助

我在NestJS中通过JwtStrategy类验证用户访问令牌，自行实现后还试过多种教程方案，但始终无法成功。即使切换到Auth0，仍持续收到401错误。不过我的LocalStrategy运行正常，能正常输出访问令牌及其他预期信息。

JwtStrategy类实现 #

import { Injectable, UnauthorizedException } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { Strategy, ExtractJwt } from 'passport-jwt';
import { passportJwtSecret } from 'jwks-rsa';

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor() {
    super({
      secretOrKeyProvider: passportJwtSecret({
        cache: true,
        rateLimit: true,
        jwksRequestsPerMinute: 3,
        jwksUri: `https://cognito-idp.${process.env.AWS_REGION}.amazonaws.com/${process.env.AWS_COGNITO_USER_POOL_ID}/.well-known/jwks.json`,
      }),

      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      audience: process.env.AWS_COGNITO_CLIENT_ID,
      issuer: `https://cognito-idp.${process.env.AWS_REGION}.amazonaws.com/${process.env.AWS_COGNITO_USER_POOL_ID}`,
      algorithms: ['RS256'],
    });
  }

  validate(payload: any) {
    if (!payload) {
      throw new UnauthorizedException();
    }

    return payload;
  }
}

AuthModule实现 #

import { Module } from '@nestjs/common';
import { JwtStrategy } from './jwt.strategy';
import { LocalStrategy } from './local.strategy';
import { PassportModule } from '@nestjs/passport';

@Module({
  imports: [PassportModule.register({ defaultStrategy: 'jwt' })],
  providers: [JwtStrategy, LocalStrategy],
  exports: [],
})
export class AuthModule {}

测试端点代码 #

import { Controller, Get, UseGuards } from '@nestjs/common';
import { AppService } from './app.service';
import { AuthGuard } from '@nestjs/passport';

@Controller()
export class AppController {
  constructor(private readonly appService: AppService) {}

  @Get()
  @UseGuards(AuthGuard('jwt'))
  getHello(): string {
    return this.appService.getHello();
  }
}

JwtAuthGuard实现 #

import { Injectable } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Injectable()
export class JwtAuthGuard extends AuthGuard('jwt') {}

已完成的排查工作 #

• 移除端点中的@UseGuards(AuthGuard('jwt'))后，接口能返回预期结果
• 尝试过Cognito和Auth0的令牌及对应实现，排除身份提供商本身的问题
• 验证JWKS地址能返回正确的JSON数据
• 反复核对JwtStrategy类中使用的所有环境变量，确认配置无误
• 确认访问令牌是有效的JWT格式

内容的提问来源于stack exchange，提问作者erasmus