企业官网建设流程全解析

GraphQL vs RESTful：API认证机制中的JWT集成对比

一、API认证的统一命题

无论选择 GraphQL 还是 RESTful，JWT 集成都是无法回避的工程问题。表面上看，两者都是通过 HTTP 传输 Token，但实际集成方式和安全考量有显著差异。

RESTful 的认证逻辑分散在各个端点中，每个端点独立校验。GraphQL 则在网关层统一处理认证，后端的 Resolver 只需关注业务逻辑。这两种模式在灵活性、安全性和工程复杂度上各有取舍。

二、认证架构对比

三、RESTful JWT 集成

3.1 中间件链式认证

const express = require('express'); const jwt = require('jsonwebtoken'); const app = express(); // 基础认证中间件 function authenticate(req, res, next) { const authHeader = req.headers.authorization; if (!authHeader || !authHeader.startsWith('Bearer ')) { return res.status(401).json({ error: '未提供认证令牌' }); } const token = authHeader.split(' ')[1]; try { const decoded = jwt.verify(token, process.env.JWT_SECRET); req.user = decoded; next(); } catch (error) { return res.status(401).json({ error: '令牌无效或已过期' }); } } // 角色鉴权中间件 function authorize(...allowedRoles) { return (req, res, next) => { if (!req.user) { return res.status(401).json({ error: '未认证' }); } if (!allowedRoles.includes(req.user.role)) { return res.status(403).json({ error: '权限不足' }); } next(); }; } // 资源所有者检查 function checkOwnership(resourceType) { return async (req, res, next) => { const resourceId = req.params.id; const resource = await db[resourceType].findByPk(resourceId); if (!resource) { return res.status(404).json({ error: '资源不存在' }); } if (resource.userId !== req.user.sub && req.user.role !== 'admin') { return res.status(403).json({ error: '无权操作此资源' }); } req.resource = resource; next(); }; } // 路由应用 app.post('/api/auth/login', async (req, res) => { const { username, password } = req.body; const user = await authenticateUser(username, password); const token = jwt.sign( { sub: user.id, name: user.name, role: user.role }, process.env.JWT_SECRET, { expiresIn: '1h' } ); const refreshToken = jwt.sign( { sub: user.id, type: 'refresh' }, process.env.REFRESH_SECRET, { expiresIn: '7d' } ); res.json({ token, refreshToken }); }); app.get('/api/users/:id', authenticate, checkOwnership('users'), (req, res) => { res.json(req.resource); }); app.get('/api/admin/users', authenticate, authorize('admin'), async (req, res) => { const users = await db.users.findAll(); res.json(users); }); app.post('/api/posts', authenticate, async (req, res) => { const post = await db.posts.create({ ...req.body, userId: req.user.sub }); res.status(201).json(post); });

3.2 RESTful 的认证问题

// 问题1: 认证逻辑重复 app.get('/api/posts', authenticate, async (req, res) => { // 每个需要认证的路由都要加 authenticate }); app.post('/api/posts', authenticate, authorize('editor'), async (req, res) => { // 权限组合可能很复杂 }); app.put('/api/posts/:id', authenticate, authorize('editor'), checkOwnership('posts'), async (req, res) => { // 链式中间件长度不可控 }); // 问题2: 认证与业务逻辑耦合 app.get('/api/posts/:id/comments', authenticate, async (req, res) => { // 认证逻辑在中间件中处理，但业务逻辑需要用户信息 const comments = await db.comments.findAll({ where: { postId: req.params.id }, include: [{ model: db.users, attributes: ['id', 'name'] }] }); // 业务层需要额外判断 const filteredComments = comments.map(comment => { if (comment.userId === req.user.sub || req.user.role === 'admin') { return comment; } const { email, ...rest } = comment.toJSON(); return rest; }); res.json(filteredComments); });

四、GraphQL JWT 集成

4.1 全局认证上下文

const { ApolloServer, gql, AuthenticationError } = require('apollo-server'); const jwt = require('jsonwebtoken'); const typeDefs = gql` type Query { user(id: ID!): User posts(limit: Int): [Post!]! adminUsers: [User!]! @auth(requires: ADMIN) } type Mutation { login(username: String!, password: String!): AuthPayload! refreshToken(token: String!): AuthPayload! createPost(input: PostInput!): Post! } type AuthPayload { token: String! refreshToken: String! user: User! } directive @auth(requires: Role = USER) on OBJECT | FIELD_DEFINITION enum Role { USER EDITOR ADMIN } type User { id: ID! name: String! email: String! @auth(requires: USER) role: Role! } type Post { id: ID! title: String! content: String! author: User! } `; // 认证上下文构建 function getAuthContext({ req }) { const authHeader = req.headers.authorization; if (!authHeader) { return { user: null }; } const token = authHeader.split(' ')[1]; try { const decoded = jwt.verify(token, process.env.JWT_SECRET); return { user: decoded }; } catch { return { user: null }; } } // 自定义认证指令 class AuthDirective extends SchemaDirectiveVisitor { visitObject(type) { this.ensureFieldsWrapped(type); type._requiredAuthRole = this.args.requires; } visitFieldDefinition(field, details) { this.ensureFieldsWrapped(details.objectType); field._requiredAuthRole = this.args.requires; } ensureFieldsWrapped(objectType) { if (objectType._authFieldsWrapped) return; objectType._authFieldsWrapped = true; const fields = objectType.getFields(); for (const fieldName of Object.keys(fields)) { const field = fields[fieldName]; const originalResolve = field.resolve; field.resolve = async function (...args) { const [, , context] = args; const requiredRole = field._requiredAuthRole || objectType._requiredAuthRole; if (requiredRole) { if (!context.user) { throw new AuthenticationError('需要登录'); } const roleHierarchy = { USER: 1, EDITOR: 2, ADMIN: 3 }; const userLevel = roleHierarchy[context.user.role] || 0; const requiredLevel = roleHierarchy[requiredRole] || 0; if (userLevel < requiredLevel) { throw new AuthenticationError('权限不足'); } } if (originalResolve) { return originalResolve.apply(this, args); } return defaultFieldResolver.apply(this, args); }; } } } const resolvers = { Query: { user: async (_, { id }, { dataSources }) => { return dataSources.userAPI.getUser(id); }, posts: async (_, { limit }, { dataSources }) => { return dataSources.postAPI.getPosts(limit); }, adminUsers: async (_, __, { dataSources }) => { return dataSources.userAPI.getAllUsers(); } }, Mutation: { login: async (_, { username, password }) => { const user = await authenticateUser(username, password); const token = jwt.sign( { sub: user.id, name: user.name, role: user.role }, process.env.JWT_SECRET, { expiresIn: '1h' } ); const refreshToken = jwt.sign( { sub: user.id, type: 'refresh' }, process.env.REFRESH_SECRET, { expiresIn: '7d' } ); return { token, refreshToken, user }; }, createPost: async (_, { input }, { user, dataSources }) => { if (!user) { throw new AuthenticationError('需要登录'); } return dataSources.postAPI.createPost({ ...input, authorId: user.sub }); } }, Post: { author: async (post, _, { dataSources }) => { return dataSources.userAPI.getUser(post.authorId); } } }; const server = new ApolloServer({ typeDefs, resolvers, context: getAuthContext, schemaDirectives: { auth: AuthDirective } });

4.2 GraphQL 的认证优势

// 优势1: 字段级权限控制 const typeDefs = gql` type User { id: ID! name: String! email: String! @auth(requires: USER) phone: String @auth(requires: ADMIN) ssn: String @auth(requires: ADMIN) } `; // 查询时自动应用字段级权限 query GetUserProfile { user(id: "1") { name // 公开 email // 需要USER角色 phone // 需要ADMIN角色，无权限时返回null } }

// 优势2: 认证与业务完全分离 const resolvers = { Query: { sensitiveData: async (_, args, { user }) => { // Resolver 专注于数据获取 const data = await db.sensitiveData.findAll(); // 认证已经在指令层处理 return data; } } };

五、刷新令牌机制对比

// RESTful 刷新 app.post('/api/auth/refresh', async (req, res) => { const { refreshToken } = req.body; try { const decoded = jwt.verify(refreshToken, process.env.REFRESH_SECRET); const newToken = jwt.sign( { sub: decoded.sub }, process.env.JWT_SECRET, { expiresIn: '1h' } ); res.json({ token: newToken }); } catch { res.status(401).json({ error: '刷新令牌无效' }); } });

// GraphQL 刷新 const typeDefs = gql` extend type Mutation { refreshToken(token: String!): AuthPayload! } `; const resolvers = { Mutation: { refreshToken: async (_, { token }) => { try { const decoded = jwt.verify(token, process.env.REFRESH_SECRET); const newToken = jwt.sign( { sub: decoded.sub }, process.env.JWT_SECRET, { expiresIn: '1h' } ); return { token: newToken }; } catch { throw new AuthenticationError('刷新令牌无效'); } } } };

六、选型建议

GraphQL 在认证集成上的最大优势是统一性：所有认证逻辑集中在 Context 构建层和 Schema 指令层，Resolver 只需关注业务数据获取。RESTful 的优势在于其认证模式与HTTP协议深度绑定，中间件链清晰直观。对于新项目，推荐使用 GraphQL 的指令式认证；对于已有 RESTful 体系，可以通过 API Gateway 统一认证入口，避免在每个微服务中重复实现。