Search code examples
node.jsjwtexpress-jwt

NodeJS JWT Verify Fail even token if it's the same as the sign token


Trying to develop my API on NodeJS, I get my sign token and send it back on secure api routes, but the jwt is never valid even if it's the same token I generated! What is wrong in my code ?

I did my sign that way

pbkdf2(queryPassword, salt, 10000, length, digest, (err: Error, hash: Buffer) => {
  if (hash.toString('hex') === userPassword) {
    sign({'user': username, permissions: []}, secret, {expiresIn: '7d'}, (err, token => {
      response.json({'token': token});
    }));
  } else {
    response.json({'error': 'User / Password Mismatch'});
  }
});

Here is the verify:

verify(token, secret, function(tokenError, decoded) {
    if (tokenError) { // i'm always getting error...
        return response.status(403).json({
            message: 'Invalid token, please Log in first'
        });
    }

    next();
});

here is my Angular2 service that request data from my API

let headers = new Headers({'Authorization': 'Bearer ' + this.token});
let options = new RequestOptions({headers: headers});
this.http.get(apiUrl, options);

token generated by sign:

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoidHQiLCJwZXJtaXNzaW9ucyI6W10sImlhdCI6MTQ4MzExNTAzNCwiZXhwIjoxNDgzNzE5ODM0fQ.bJbH4619JAU8pf_6qcYl0V1V5PxWsPBRYeXbeb6VL_M

token received by http service:

Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoidHQiLCJwZXJtaXNzaW9ucyI6W10sImlhdCI6MTQ4MzExNTAzNCwiZXhwIjoxNDgzNzE5ODM0fQ.bJbH4619JAU8pf_6qcYl0V1V5PxWsPBRYeXbeb6VL_M


Solution

  • I finally found my error....

    In my angular2 Api i was using this line

    let headers = new Headers({'Authorization': 'Bearer ' + this.token});
    

    i need to send only

    let headers = new Headers({'Authorization': this.token});
    

    the 'Bearer ' was causing me the error...