尝试验证时 JWT 格式错误

Question

I know this question get asked a lot, but i just can't find what the problem is, So i already signed the some data with a token and when i try to verify it, it return "jwt malformed", although when i console log the both the token and the "secret token" in my dotenv file, they are all the same: the token receive from the authheader: 1e0af40b5849caa62d2bd4a65fddc832b027034fe656d50003b86e1417af6491c944b9ed936e5090d114a4c81aa09754d920daa58736f3ba6d49977cc271a0dd , same goes the token in dotenv file : 1e0af40b5849caa62d2bd4a65fddc832b027034fe656d50003b86e1417af6491c944b9ed936e5090d114a4c81aa09754d920daa58736f3ba6d49977cc271a0dd . Aren't the jwt verify method only check whether the two string matches, do i need more configuration in the signing method? like specifying the signing algo or type: this is my middleware code for verify:

function authenticateToken(req , res , next){
  const authHeader = req.headers.authorization;
  const token = authHeader && authHeader.split(' ')[1]
  console.log(token)
  if(token == null)return res.status(401).send()
  
    jwt.verify(token , process.env.ACCESS_TOKEN_SECRET , (err , user)=>{
      console.log(process.env.ACCESS_TOKEN_SECRET)
      console.log(err)
    if(err){return res.status(403).send()}
    console.log(err)
    req.new_user = user;
    
    next()
  })
}

return some value after verification :

  isLoggedIn(app ,db){
    app.get('/isLoggedIn'  , authenticateToken, async(req ,res)=>{
    await db.query('select * from client where username = $1' , [req.new_user.name] , (err , data)=>{
      res.json(data.rows[0])
    })
    
    
    })
  }

And I probably don't think the issues lies here since:

logging_auth(app ,db){
    app.post('/logging_auth' , async(req ,res)=>{
      let credential = req.body
      let email = credential.login_email;
      let password = credential.login_password
      let email_cols = [email];
      await db.query('select client_password  , username from client where email = $1' , email_cols , async(err , data)=>{
        if(data && data.rows.length === 0){
          res.json({
            success : false,
            msg : 'email or password does not exist'
          })
        }
        if(data && data.rows.length === 1){
          bycrypt.compare(password , data.rows[0].client_password , (bcrypterr , verified)=>{
            //if verified gives token
            if(verified){
              const new_user = {name : data.rows[0].username}
              jwt.sign(new_user , process.env.ACCESS_TOKEN_SECRET)
              res.json({access_token :  process.env.ACCESS_TOKEN_SECRET , success : true , use:new_user.name})
            }else{
              console.log(bcrypterr)
            }
            //else resposne success false
          })
        }
        if(err){
          res.json({
            success : false,
            msg : 'Opps Something Went Wrong',
            status : 501
          })
        }
      })
    })

  }

the error happens only during the verification process.

Answer 1

The issue is in your last code snippet. You are sending your JWT private key. jwt.sign() returns a JWT. So instead of these lines:

jwt.sign(new_user , process.env.ACCESS_TOKEN_SECRET)
res.json({access_token :  process.env.ACCESS_TOKEN_SECRET , success : true , use:new_user.name})

Try it like this:

const access_token= jwt.sign(new_user, process.env.ACCESS_TOKEN_SECRET)
res.json({access_token, success : true , use:new_user.name})

In your response, you should then receive a token that looks something like this: xxxxx.yyyyy.zzzzz , where x is the header, y is the payload (your user data) and z is the signature.

You can read more about the structure of a JWT on JWT.io .