nodejs - JSONWebToken expiration issue

Question

I'm trying to authenticate my nodejs api using Json Web Token (with the help of this article ) but the problem is that the token never expires.

var express = require('express');
var app = express();
var mongoose = require('mongoose');
var bodyParser = require('body-parser');
var jwt = require('jsonwebtoken');




mongoose.connect('mongodb://localhost/gd');
var schema = mongoose.Schema;

app.use(bodyParser.urlencoded({ extended: false }));
app.use(bodyParser.json());

var router = express.Router();

app.use('/api', router);

var userSchema = new schema({
   username: String,
   password: String
},{
    collection: 'users'
});

var User = mongoose.model('User', userSchema);



router.post('/authenticate', function(req, res) {

  User.findOne({
    username: req.body.username
  }, function(err, user) {

    if (err) throw err;

    if (!user) {
      res.json({ success: false, message: 'Authentication failed. User not found.' });
    } else if (user) {

      if (user.password != req.body.password) {
        res.json({ success: false, message: 'Authentication failed. Wrong password.' });
      } else {

        var token = jwt.sign(user, "secret", {
          expiresIn: 60
        });

        res.json({
          success: true,
          message: 'Enjoy your token!',
          token: token
        });
      }   

    }

  });
});



router.use(function(req, res, next) {

  var token = req.body.token || req.query.token || req.headers['x-access-token'];

  if (token) {

    jwt.verify(token, "secret", function(err, decoded) {      
      if (err) {
        return res.json({ success: false, message: 'Failed to authenticate token.' });    
      } else {
        req.decoded = decoded;    
        next();
      }
    });

  } else {

    return res.status(403).send({ 
        success: false, 
        message: 'No token provided.' 
    });

  }
});

router.get('/users', function(req, res) {
  User.find({}, function(err, users) {
    res.json(users);
  });
});  

var server = app.listen(3001, function () {
  var host = server.address().address;
  var port = server.address().port;

});

Answer 1

In order to know the expiry of the token, jwt adds an exp attribute to the payload. However, your payload as you pass it to jwt.sign is a mongoose object, which will (silently) not allow you to add an attribute which is not defined in the schema.

The solution should be to convert the user to a normal object before passing it as the payload :

var token = jwt.sign(user.toObject(), "secret", {
  expiresIn: 60
});