Update middleware to throw when token is invalid when credentials are…

…n't required
auth0 · Aug 2, 2016 · fd58e89 · fd58e89 · zoellner · Feb 7, 2017
1 parent 15da043
commit fd58e89
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 13 deletions.
diff --git a/lib/index.js b/lib/index.js
@@ -96,7 +96,7 @@ module.exports = function(options) {
       },
       function verifyToken(secret, callback) {
         jwt.verify(token, secret, options, function(err, decoded) {
-          if (err && credentialsRequired) {
+          if (err) {
             callback(new UnauthorizedError('invalid_token', err));
           } else {
             callback(null, decoded);

diff --git a/test/jwt.test.js b/test/jwt.test.js
@@ -159,6 +159,32 @@ describe('failure tests', function () {
       });
   });
 
+  it('should throw error if token is expired even with when credentials are not required', function() {
+      var secret = 'shhhhhh';
+      var token = jwt.sign({foo: 'bar', exp: 1382412921}, secret);
+
+      req.headers = {};
+      req.headers.authorization = 'Bearer ' + token;
+      expressjwt({ secret: secret, credentialsRequired: false })(req, res, function(err) {
+          assert.ok(err);
+          assert.equal(err.code, 'invalid_token');
+          assert.equal(err.message, 'jwt expired');
+      });
+  });
+
+  it('should throw error if token is invalid even with when credentials are not required', function() {
+      var secret = 'shhhhhh';
+      var token = jwt.sign({foo: 'bar', exp: 1382412921}, secret);
+
+      req.headers = {};
+      req.headers.authorization = 'Bearer ' + token;
+      expressjwt({ secret: "not the secret", credentialsRequired: false })(req, res, function(err) {
+          assert.ok(err);
+          assert.equal(err.code, 'invalid_token');
+          assert.equal(err.message, 'invalid signature');
+      });
+  });
+
 });
 
 describe('work tests', function () {
@@ -216,18 +242,6 @@ describe('work tests', function () {
     });
   });
 
-  it('should work if token is expired and credentials are not required', function() {
-    var secret = 'shhhhhh';
-    var token = jwt.sign({foo: 'bar', exp: 1382412921}, secret);
-
-    req.headers = {};
-    req.headers.authorization = 'Bearer ' + token;
-    expressjwt({ secret: secret, credentialsRequired: false })(req, res, function(err) {
-      assert(typeof err === 'undefined');
-      assert(typeof req.user === 'undefined')
-    });
-  });
-
   it('should not work if no authorization header', function() {
     req = {};
     expressjwt({ secret: 'shhhh' })(req, res, function(err) {