能否通过JwtStrategy修改JWT字符串？技术咨询

Great question! The short answer is: Yes, but how you do it depends on what exactly you want to change—either the decoded payload used by your server, or the actual token string sent back to the client. Let’s break this down with practical examples tied to your code:

1. Tweaking the Decoded Payload (Most Common Use Case) #

Your JwtStrategy’s verify callback gets the decoded payload from the incoming JWT. You can modify this payload before passing it to done(), which will change what ends up attached to req.user for your routes/middleware.

For example, if you wanted to add a default role or update a timestamp on the fly:

passport.use( 
  new JwtStrategy({ 
    secretOrKey: credentials.secret, 
    jwtFromRequest: ExtractJwt.fromAuthHeader(), 
  }, function(payload, done) { 
    // Modify the payload right here before processing
    payload.lastAuthenticated = new Date().toISOString();
    // Add a fallback role if the payload doesn't include one
    payload.role = payload.role || 'basic_user';

    // Continue with your existing user lookup logic
    User.findBy... // Your existing code here
    // When you call done(), pass the modified payload (or merge it with user data)
    return done(null, { ...user, ...payload });
  })
);

This change only affects how your server uses the token data—it doesn’t alter the original JWT string sent by the client.

2. Changing the Actual JWT String (If You Need to Issue a New Token) #

If you need the client to receive an updated JWT (with modified claims), you can’t do this directly in JwtStrategy—that’s not its job (it’s for verifying tokens, not issuing new ones). Instead:

1. Let JwtStrategy verify the original token as usual
2. In your route handler, generate a new token with the updated data
3. Send the new token back to the client

Using your existing generateToken function, here’s how that might look:

exports.someProtectedRoute = function(req, res) {
  // Get the current user info from req.user (populated by JwtStrategy)
  const updatedUserInfo = { ...getUserInfo(req.user), lastActive: new Date() };
  // Generate a brand new token with the modified data
  const updatedToken = 'JWT ' + generateToken(updatedUserInfo);
  
  // Send the new token and updated user info to the client
  res.status(200).json({
    token: updatedToken,
    userInfo: updatedUserInfo
  });
};

The client can then store this new token and use it for future requests.

Quick Reminder #

• JwtStrategy is for verifying incoming tokens, not modifying them. Any payload changes in the strategy only live on your server during the request.
• If you need the client to use updated token data, you have to explicitly send a new token—there’s no way to "edit" the original token string mid-verification.

内容的提问来源于stack exchange，提问作者davidesp