Dostaję odpowiedź 403 Forbidden

Wykonuje requets PATCH w axios i dostaje nastepujacy blad. Co moze byc zle napisane ?

xhr.js:251     PATCH http://localhost:3000/addfriend/q/44608 403 (Forbidden)

w pliku na serwerze mam:

app.patch("/addfriend/:email/:userId", verifyToken, async (req,res)=>{
  console.log(9999999)  
});   

request nie przechodzi verifyToken

const AddF = async (friend: IFriend): Promise<any[]> => {
  const resp = await api.patch<any[]>(
    BASE_URL +
      "/addfriend/" +
      (friend.login && friend.login.email) +
      "/" +
      friend.userid,{method:"PATCH",
          Headers: {
     Authorization: `Bearer ${friend.token}`,
     'Content-Type': 'application/json',
 },      body: JSON.stringify({}),
      },
  );
  return resp.data;
};

import express from "express";
import bodyParser from "body-parser";

import cors from "cors";

import dotenv from "dotenv";
import multer from "multer";
import helmet from "helmet";
import morgan from "morgan";
import path from "path";
import { fileURLToPath } from "url";
import authRoutes from "./routes/auth.js";
import userRoutes from "./routes/users.js";
import postRoutes from "./routes/posts.js";
import { loginUser, register } from "./routes/auth.js";
import {
  createComment,
  createPost,
  doLikes,
  postsOfUser, 
  getFeedPosts,
  getComments,
} from "./routes/posts.js";
import { addFriend, getUser, getFriends, getUsers } from "./routes/users.js";
import { verifyToken } from "./middleware/auth.js";

import { usersarr, posts, userIds, socketids } from "./data/index.js";
import http from "http";
import bcrypt from "bcrypt";
import jwt from "jsonwebtoken";

/* CONFIGURATIONS */
const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);
dotenv.config();
const app = express();

const server = http.createServer(app);
import { Server } from "socket.io";

app.use(express.json());
app.use(bodyParser.json({ limit: "30mb", extended: true }));
app.use(bodyParser.urlencoded({ limit: "30mb", extended: true }));
app.use(cors({ origin : '*'}))
app.use("/assets", express.static(path.join(__dirname, "public/assets")));
const serv = app.listen(3002);
const io = new Server(serv, {
  cors: {
    "Access-Control-Allow-Origin": "http://localhost:3002:*",
    "Access-Control-Request-Method": "*",
  },
});

io.on("connection", async (socket) => {
  socket.on("message_about_userid", (userid) => {
    socketids.set(userid.uid, socket.id);
    console.log(":::::::::::::::::::::::::k   " + userid.uid);

    // req.app.get('socketio').to(socketids.get(usersarr[usersarr.findIndex((t)=>{t.email===email})]._id)).emit('message_from_likes',
    // `user ${email} has logged`)

    // console.log("Made socket connection");
  });
});

app.set("socketio", io);

/* FILE STORAGE */
const storage = multer.diskStorage({
  destination: function (req, file, cb) {
    cb(null, "public/assets");
  },
  filename: function (req, file, cb) {
    cb(null, file.originalname);
  },
});
const upload = multer({ storage });
/* REGISTER USER */

app.put("/auth/register", upload.single("picture"), register);
app.post("/posts", verifyToken, upload.single("picture"), createPost);

/* ROUTES */

app.post("/login", loginUser); 
 
app.get("/friends", getFriends);  
/* READ */    
app.get("/p", verifyToken, getFeedPosts); 
app.get("/users", verifyToken, getUsers);
app.get("/users/:userId", verifyToken, getUser);
app.get("/:userId/posts", verifyToken, postsOfUser); 
app.patch("/:id/:userId/likes", verifyToken, doLikes);
app.patch("/addfriend/:email/:userId", verifyToken, async (req,res)=>{
  console.log(9999999)  
});      
app.patch("/createpost", verifyToken, createPost);
app.patch("/createcomment", verifyToken, createComment); 
       
//            
    
const PORT = process.env.PORT || 3000; 

server.listen(PORT, () => console.log(`Server Port: ${PORT}`));

wydaje mi się, że albo źle podajesz ten token, albo źle go weryfikujesz.

import { verifyToken } from "./middleware/auth.js";

co robi dokładnie ta funkcja?

LukeJL napisał(a):

wydaje mi się, że albo źle podajesz ten token, albo źle go weryfikujesz.

import { verifyToken } from "./middleware/auth.js";

co robi dokładnie ta funkcja?

tak to wyglada

import jwt from "jsonwebtoken";

export const verifyToken = async (req, res, next) => {
  try {
    let token = req.header("Authorization");

    if (!token) {
      return res.status(403).send("Access Denied");
    }

    if (token.startsWith("Bearer ")) {
      token = token.slice(7, token.length).trimLeft();
    }

    const verified = jwt.verify(token, process.env.JWT_SECRET);
    req.user = verified;
    next();
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
};

const resp = await api.patch<any[]>(
    BASE_URL +
      "/addfriend/" +
      (friend.login && friend.login.email) +
      "/" +
      friend.userid,{method:"PATCH",
          Headers: {

co to za api.patch? Czy na pewno tam jest Headers z wielkiej litery, a nie headers?

Sprawdź, czy wysyłasz poprawnie te nagłówki, i czy nie wpada w tego ifa:

let token = req.header("Authorization");
if (!token) {
   return res.status(403).send("Access Denied");
}