1

I am trying to implement JWT authentication. /login and /register work fine and they return authentication token, but when I try to GET /secret with a header 'Authorization' = 'JWT token_received', it returns a string 'unauthorized' and I can see no logging from JWTStrategy. Please let me know where I am going wrong.

var opts = {}
opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken();
opts.secretOrKey = "very_secret"

passport.use(new JwtStrategy(opts, function(payload, next){
    console.log("payload received" + payload);
    User.findById(payload.id, function(err, user){
        console.log("user found:" + user);
        if(err){
            return next(err, false)
        }
        else if(user){
            return next(null, user)
        }
        else{
            return next(null, false)
        }
    });
    }
));

app.use(passport.initialize());

app.post("/login", function(req, res){

        var email = req.body.email;
        var password = req.body.password;

        var user = User.findOne({"email": email}, function(err, user){

        if(err){
            res.json({"error": err});
            return;
        }
        if(!user){
            res.json({"message": "No user found"});
            return;
        }
        if(user.password == password){
            res.json(
                { 
                    "message": "User found",
                    "token": jwt.sign({"id": user.id}, opts.secretOrKey)
                }
            );
        }
        else{
            res.json({"message": "Password did not match"});
        }
    });
});

app.post("/register", function(req, res){
new User({ email: req.body.email, password: req.body.password}).
    save(function(err, user){
            if(err){
                res.json({"message": "User cannot be created"});
            }
            else{
                res.json(
                    { 
                        "message": "ok",
                        "token": jwt.sign({"id": user.id}, opts.secretOrKey)
                    }
                );
            }
    });
});

app.get("/secret", passport.authenticate("jwt", {session: false}), function(req, res){
    console.log(req.get('Authorization'));
    res.json(req.user);
});

Using postman as the client. Request details from postman,

GET /secret HTTP/1.1
Host: localhost:3000
Content-Type: application/x-www-form-urlencoded
Authorization: JWT token_I_received_on_login
Cache-Control: no-cache
Postman-Token: 114060a3-3074-6688-6245-0b0cfe7e9f04
3
  • Is the client sending over Authorization? Post assumes your REST client or browser is requesting this correctly. Commented Sep 3, 2017 at 2:51
  • Can you post your code how you are passing jwt-token to the server? Commented Sep 3, 2017 at 2:57
  • Using postman to test, added request details. I feel there is some problem with Strategy since it is not logging anything but am not sure. Commented Sep 3, 2017 at 3:24

2 Answers 2

1

Got it. Made a mistake in the request.

As per the README, it should be 'Authorization' = 'bearer token_received_on_login'

Sign up to request clarification or add additional context in comments.

1 Comment

I have same problem. but I don't understand the process of passport-jwt. how to add ** it should be 'Authorization' = 'bearer token_received_on_login'** as you said? I don't understand it :((((
0
opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken();

should be

ExtractJwt.fromAuthHeaderWithScheme('jwt');

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.