Question

137

Node.js - Express.js JWT always returns an invalid token error in browser response

rated 0 times [ 141] [ 4] / answers: 1 / hits: 41664 / 10 Years ago, wed, february 19, 2014, 12:00:00

I'm using node.js and express.js with the express-jwt module, and I have set up a simple HTTP server to test everything:

This is the node code involved:

 app.set('port', process.env.PORT || 3000);

    app.use(express.methodOverride());

    app.use(allow_cross_domain);

    app.use('/api', expressJwt({secret: '09qrjjwef923jnrge$5ndjwk'}));

    app.use(express.json());

    app.use(express.urlencoded());

    app.use('/', express.static(__dirname + '/'));

    app.use(function(err, req, res, next){

      if (err.constructor.name === 'UnauthorizedError') {

        res.send(401, 'Unauthorized');

      }

    });



    app.get('login',function(req,res){



    //...

    jwt.sign(results.username+results.email, secret, { expiresInMinutes: 9000000000*9393939393393939393939 });

    });



    app.post('api/profile',function(req,res){

     console.log(req.user); // this return undefined in console

     res.send(req.user); // response is pending and dunno why it returns error in browser console

    });

So once I open the /login URL I get logged in and I send the session token to api/post, which returns this response error in the browser console:

{error:{message:invalid signature,code:invalid_token,status:401,inner:{}}}

I don't understand why this is happening, because the token stored in the front-end and the token in JWT are the same. What could be the reason for this error?

An example of headers POSTed to the api/post URL:

enter

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

terrencegreysons

Add To Favorites

Follow

Total Points: 674

Total Questions: 102

Total Answers: 105

Location: New Caledonia

Member since Thu, Mar 23, 2023

1 Year ago

answered 10 Years ago jaelyn · Accepted Answer

Here is an example

http://blog.auth0.com/2014/01/07/angularjs-authentication-with-cookies-vs-token/

var expressJwt = require('express-jwt');

var jwt = require('jsonwebtoken');



var SECRET = 'shhhhhhared-secret';



app.use('/api', expressJwt({secret: SECRET}));



app.post('/authenticate', function (req, res) {

  //TODO validate req.body.username and req.body.password

  //if is invalid, return 401

  if (!(req.body.username === 'john.doe' && req.body.password === 'foobar')) {

    res.send(401, 'Wrong user or password');

    return;

  }



  var profile = {

    first_name: 'John',

    last_name: 'Doe',

    email: '[email protected]',

    id: 123

  };



  // We are sending the profile inside the token

  var token = jwt.sign(profile, SECRET, { expiresIn: 18000 }); // 60*5 minutes



  res.json({ token: token });

});



app.get('/api/protected', 

  function(req, res) {  

    res.json(req.user);

  });