NestJS GraphQL复用JWT令牌：存储方案及Redis适用性咨询

Hey there! Great question—handling reusable JWT tokens for external API calls in NestJS GraphQL is a super common scenario, and you’re spot-on to consider Redis here. Let’s break down the best approaches, including why Redis is a perfect fit, alternatives, and concrete implementation steps.

1. Redis: 生产环境的首选存储 #

Redis is absolutely ideal for this use case, and here’s why:

• Fast read/write: As an in-memory key-value store, it’s lightning-quick to retrieve tokens, which is critical for keeping your GraphQL resolver performance snappy.
• Built-in expiration: You can set a TTL (time-to-live) of exactly 1 hour when storing the token—Redis will automatically delete it once it expires, so you never have to manually track validity.
• Cross-instance sharing: If your NestJS app runs on multiple instances (like in a Kubernetes cluster), Redis acts as a centralized cache. This ensures all instances reuse the same valid token instead of each fetching their own, reducing unnecessary calls to the external API.

2. Alternatives (for non-production or single-instance setups) #

If you’re working on a small, single-instance service (e.g., local development or a low-traffic app), you could use NestJS’s built-in CacheModule with an in-memory store. However, this has big limitations:

• Tokens are lost when the app restarts.
• Multiple instances can’t share the token, leading to redundant API calls.
• It’s not suitable for production scalability.

3. Concrete Implementation in NestJS GraphQL #

Here’s a step-by-step guide to wire this up:

Step 1: Install Dependencies #

First, add the required packages for cache management and Redis:

npm install @nestjs/cache-manager cache-manager-redis-yet
# or
yarn add @nestjs/cache-manager cache-manager-redis-yet

Step 2: Configure the Cache Module #

In your root module (e.g., AppModule), import and configure the cache module to connect to Redis:

import { Module } from '@nestjs/common';
import { CacheModule } from '@nestjs/cache-manager';
import { redisStore } from 'cache-manager-redis-yet';
import { TokenService } from './token.service';

@Module({
  imports: [
    CacheModule.registerAsync({
      useFactory: async () => ({
        store: await redisStore({
          url: 'redis://localhost:6379', // Replace with your Redis URL
        }),
      }),
      isGlobal: true, // Makes the cache available across all modules
    }),
  ],
  providers: [TokenService],
  exports: [TokenService],
})
export class AppModule {}

Step 3: Create a Token Service #

Build a dedicated service to handle token fetching and caching—this keeps your resolver code clean and reusable:

import { Injectable, Inject } from '@nestjs/common';
import { CACHE_MANAGER } from '@nestjs/cache-manager';
import { Cache } from 'cache-manager';

@Injectable()
export class TokenService {
  constructor(@Inject(CACHE_MANAGER) private readonly cacheManager: Cache) {}

  async getValidToken(): Promise<string> {
    // Check cache first for a valid token
    const cachedToken = await this.cacheManager.get<string>('external_api_jwt');
    if (cachedToken) {
      return cachedToken;
    }

    // Fetch a new token from the external API if cache is empty
    const newToken = await this.fetchTokenFromExternalApi();
    
    // Store the token in Redis with 1-hour TTL (3600 seconds)
    await this.cacheManager.set('external_api_jwt', newToken, 3600);
    return newToken;
  }

  // Private method to handle the actual API call
  private async fetchTokenFromExternalApi(): Promise<string> {
    // Replace with your external API token endpoint and authentication logic
    const response = await fetch('https://your-external-api.com/auth/token', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        client_id: process.env.EXTERNAL_API_CLIENT_ID,
        client_secret: process.env.EXTERNAL_API_CLIENT_SECRET,
      }),
    });

    if (!response.ok) {
      throw new Error(`Failed to fetch token: ${response.statusText}`);
    }

    const data = await response.json();
    return data.access_token;
  }
}

Step 4: Use the Token Service in Resolvers #

Inject the TokenService into your GraphQL resolvers to retrieve the token before making external API calls:

import { Resolver, Query } from '@nestjs/graphql';
import { TokenService } from './token.service';
import { Inject } from '@nestjs/common';
import { CACHE_MANAGER } from '@nestjs/cache-manager';
import { Cache } from 'cache-manager';

@Resolver()
export class ExternalDataResolver {
  constructor(
    private readonly tokenService: TokenService,
    @Inject(CACHE_MANAGER) private readonly cacheManager: Cache
  ) {}

  @Query(() => String)
  async fetchExternalData() {
    const token = await this.tokenService.getValidToken();
    
    // Make the external API call with the cached token
    const response = await fetch('https://your-external-api.com/data', {
      headers: {
        Authorization: `Bearer ${token}`,
        'Content-Type': 'application/json',
      },
    });

    if (!response.ok) {
      // Handle token expiration edge case: if the token is invalid (e.g., network delay caused cache to be stale)
      if (response.status === 401) {
        // Clear the invalid token from cache and retry
        await this.cacheManager.del('external_api_jwt');
        const freshToken = await this.tokenService.getValidToken();
        return this.fetchExternalDataWithToken(freshToken);
      }
      throw new Error(`Failed to fetch external data: ${response.statusText}`);
    }

    return response.json();
  }

  private async fetchExternalDataWithToken(token: string) {
    const response = await fetch('https://your-external-api.com/data', {
      headers: {
        Authorization: `Bearer ${token}`,
        'Content-Type': 'application/json',
      },
    });
    return response.json();
  }
}

4. Bonus Optimization Tips #

• Handle token expiration edge cases: As shown in the resolver example, add logic to retry requests if the cached token is unexpectedly invalid (e.g., due to clock drift between your server and the external API).
• Prefix cache keys: Use environment-specific prefixes (like prod_external_api_jwt) to avoid conflicts between development, staging, and production environments.
• Redis persistence: If you want to avoid losing the token if Redis restarts, enable RDB or AOF persistence. Since the token only lives for 1 hour, this is optional but can help with consistency.

内容的提问来源于stack exchange，提问作者user12883228