Node.js : How to use token with multer? - node.js

Question

I want to run two same servers. And I want to upload a image from one to the other. These sources worked well but I felt that verifying a token is needed for security.
I will use the function createUploadToOther of settings.js to send image to the other server. I usually write a router like
router.post('/fromOther', verifyToken, function (req, res) {
But in this case, I don't know where to put that verifyToken. Could u let me know how to use a token with the multer header(?) in this case?
file.js
let express = require("express");
let router = express.Router();
let path = require('path');
let uploadDir = 'static'
let fs = require('fs');
const verifyToken = require('../libs/verifyToken')
const axios = require('axios')
const FormData = require('form-data')
let multer = require('multer');
let storageForSentFile = multer.diskStorage({
destination: function (req, file, callback) {
callback(null, uploadDir);
},
filename: function (req, file, callback) {
callback(null, file.originalname);
}
})
let uploadForSentFile = multer({ storage: storageForSentFile })
router.post('/fromOther', uploadForSentFile.single('logo'), function (req, res) {
console.log("------file upload -------")
console.log(req.file)
res.json(req.file)
});
router.post('/toOther', uploadForSentFile.single('logo') , async function (req, res) {
let formData = new FormData()
formData.append('logo', fs.createReadStream(req.file.path), { knownLength: req.file.size })
const headers = {
...formData.getHeaders(),
"Content-Length": formData.getLengthSync()
};
try {
let result = await axios.post(
new URL('/file/fromOther', req.body.serverURL).href,
formData,
{headers }
)
res.status(200).json(result.data)
} catch (err) {
console.log('file/toOther err', err)
}
})
../libs/verifyToken.js
let jwt = require("jsonwebtoken");
const dotenv = require("dotenv");
function verifyToken(req, res, next) {
console.log("req.headers1 : ", req.headers);
let token = req.headers["authorization"];
if (!token)
return res.json({ status: 409, message: 'No authorization' })
jwt.verify(token, process.env.aSecretKey, function (err, decoded) {
if (err)
return res
.status(500)
.send({ auth: false, message: "Check your ID and password" });
console.log("decoded", decoded);
req.account = decoded.account;
req.idx = decoded.idx;
next();
});
}
module.exports = verifyToken;
settings.js
import axios from 'axios'
import { headers } from '../config/env'
export function createUploadToOther(data) {
return axios.post('/file/toOther', data, { headers })
}

Answer 1

Function verifyToken in router('/fromOther') checks just req.headers["authorization"], so I just added the function verifyToken to both router as argument(in fact don't need to add verifyToken to router('/toOther') but wanted to make it safer) and added the key "authorization" and the value as req.headers.authorization to router('/toOther'). Then it worked well, but I don't know this will be safe enough.
//(...)
router.post('/fromOther', verifyToken, uploadForSentFile.single('logo'), function (req, res) {
console.log("------file upload -------")
console.log(req.file)
res.json(req.file)
});
router.post('/toOther', verifyToken, uploadForSentFile.single('logo') , async function (req, res) {
let formData = new FormData()
formData.append('logo', fs.createReadStream(req.file.path), { knownLength: req.file.size })
const headers = {
...formData.getHeaders(),
"Content-Length": formData.getLengthSync(),
"authorization": req.headers.authorization
};
try {
let result = await axios.post(
new URL('/file/fromOther', req.body.serverURL).href,
formData,
{headers }
)
res.status(200).json(result.data)
} catch (err) {
console.log('file/toOther err', err)
}
})
//(...)