func (a *APIs) PostLogin(v *PostLoginReq) *kongchuanhujiao.Response {

	if v.Code != account.GetCode(v.ID) || v.Code == "" { // FIXME datahub 鉴权
		return kongchuanhujiao.GenerateErrResp(1, "验证码有误")
	}

	now := time.Now()
	t, err := jwt.NewTokenWithClaims(jwt.SigningMethodES256, jwt.MapClaims{
		"iss": config.GetJWTConf().Iss,
		"sub": v.ID,
		"exp": now.AddDate(0, 1, 0).Unix(),
		"nbf": now.Unix(),
		"iat": now.Unix(),
	}).SignedString(config.GetJWTConf().Key)
	if err != nil {
		logger.Error("生成 JWT Token 失败", zap.Error(err))
		return kongchuanhujiao.DefaultErrResp
	}

	return &kongchuanhujiao.Response{Message: t}
}
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.