For a new node.js project I'm working on, I'm thinking about switching over from a cookie based session approach (by this, I mean, storing an id to a key-value store containing user sessions in a user's browser) to a token-based session approach (no key-value store) using JSON Web Tokens (jwt).
(对于我正在研究的一个新的node.js项目，我正在考虑从基于cookie的会话方法切换（这意味着，将ID存储到用户浏览器中包含用户会话的键值存储中）到使用JSON Web令牌（jwt）的基于令牌的会话方法（无键值存储）。)
The project is a game that utilizes socket.io - having a token-based session would be useful in such a scenario where there will be multiple communication channels in a single session (web and socket.io)
(该项目是一个利用socket.io的游戏-在单个会话（web和socket.io）中会有多个通信渠道的情况下，基于令牌的会话将非常有用。)
How would one provide token/session invalidation from the server using the jwt Approach?
(如何使用jwt方法从服务器提供令牌/会话无效？)
I also wanted to understand what common (or uncommon) pitfalls/attacks I should look out for with this sort of paradigm.
(我还想了解我应该用这种范例寻找哪些常见（或不常见）的陷阱/攻击。)
For example, if this paradigm is vulnerable to the same/different kinds of attacks as the session store/cookie-based approach.(例如，如果此范例易受与基于会话存储/ Cookie的方法相同/不同类型的攻击的攻击。)
So, say I have the following (adapted from this and this ):
(因此，说我有以下内容（适应了this和this ）：)
Session Store Login:
(会话商店登录：)
app.get('/login', function(request, response) {
var user = {username: request.body.username, password: request.body.password };
// Validate somehow
validate(user, function(isValid, profile) {
// Create session token
var token= createSessionToken();
// Add to a key-value database
KeyValueStore.add({token: {userid: profile.id, expiresInMinutes: 60}});
// The client should save this session token in a cookie
response.json({sessionToken: token});
});
}
Token-Based Login:
(基于令牌的登录：)
var jwt = require('jsonwebtoken');
app.get('/login', function(request, response) {
var user = {username: request.body.username, password: request.body.password };
// Validate somehow
validate(user, function(isValid, profile) {
var token = jwt.sign(profile, 'My Super Secret', {expiresInMinutes: 60});
response.json({token: token});
});
}
--
(-)
A logout (or invalidate) for the Session Store approach would require an update to the KeyValueStore database with the specified token.
(要注销（或使会话存储方法无效），将需要使用指定的令牌更新KeyValueStore数据库。)
It seems like such a mechanism would not exist in the token-based approach since the token itself would contain the info that would normally exist in the key-value store.
(似乎这种机制在基于令牌的方法中将不存在，因为令牌本身将包含通常存在于键值存储中的信息。)
ask by funseiki translate from so
