```typescript
import { BadRequestException, Injectable } from '@nestjs/common'
import { ConfigService } from '@nestjs/config'
import { Request } from 'express'
import { Strategy } from 'passport-jwt'
import { PassportStrategy } from '@nestjs/passport'
import { IToken } from '@/user/auth/auth.decorator'

@Injectable()
export class AuthJwtStrategy extends PassportStrategy(Strategy, 'jwt') {
constructor(configService: ConfigService) {
super({
jwtFromRequest: AuthJwtStrategy.fromCookieOrHeader,
secretOrKey: configService.get('JWT_SECRET'),
})
}

public static fromCookieOrHeader(req: Request): string {
const authHeader = req.header('authorization')
if (authHeader && authHeader.startsWith('Bearer ')) {
return authHeader.substring(7, authHeader.length)
}
return req.cookies['access_token']
}

// eslint-disable-next-line class-methods-use-this
public async validate(payload: IToken): Promise<IToken> {
if (payload.type !== 'access_token') {
throw new BadRequestException('token 类型无效')
}
return payload
}
}
```

passport.js 里，passport-jwt 的 strategy 没有粗暴地从 header 取 authorization 字段而是暴露了 jwtFromRequest ，就是希望使用者可以灵活一点。