Error Audience check

[teknosains]

Always got this error

{ name: 'JsonWebTokenError',
message: 'jwt audience invalid. expected: undefined' }

I've correctly specified

jwt.verify(token,secred,{audience : 'https://asksja.com'},function(err,decoded) {

      if(err){
        console.log(err);
        return res.status(401).json({status:401,msg:"Invalid audience"});        
      }

      console.log("Audience Pass");
      next();

    });

You should try check your index.js line 103
console.log(payload);

the output still

{ audience: ff
issuer:ff
subject: fff
email: ggg
iat: 1423041815 }

and you check below it like

payload.aud , this would be 'undefine'

Also , I have this token generated from iOS library

 eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJlbWFpbCI6Im5hZHlhQHlhaG9vLmNvbSIsImF1ZGllbmNlIjoiaHR0cHM6XC9cL2FwaS50dWluZ2xlLmNvbSIsInN1YmplY3QiOiI1MTM3ODI5MjIxNDg3NDg0ODI0NDAxIiwiaXNzdWVyIjoibXlQYWNrYWdlLnR1aW5nbGUuY29tIiwiaWF0IjoxNDIwOTYwOTI0fQ==.55G6LfE9Zkse0Z7bppTK9IhhTe8DMSq0XlJrtajk4DhOSsHVBXDtwuXEeLc7t0Sv5BosV5f2NDePrSjjapBfkA== 

its valid when check it on jwt.io

but invalid signature when verify

Thanks

@jfromaniello

[jfromaniello]

The problem is that your JWT has audience but the standard claim is aud.

Check this:
https://github.com/auth0/node-jsonwebtoken/blob/master/index.js#L118

and this:
https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32#section-4.1.3

[teknosains]

The problem is

when I verify this token

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJlbWFpbCI6Im5hZHlhQHlhaG9vLmNvbSIsImF1ZGllbmNlIjoiaHR0cHM6XC9cL2FwaS50dWluZ2xlLmNvbSIsInN1YmplY3QiOiI1MTM3ODI5MjIxNDg3NDg0ODI0NDAxIiwiaXNzdWVyIjoibXlQYWNrYWdlLnR1aW5nbGUuY29tIiwiaWF0IjoxNDIwOTYwOTI0fQ==.55G6LfE9Zkse0Z7bppTK9IhhTe8DMSq0XlJrtajk4DhOSsHVBXDtwuXEeLc7t0Sv5BosV5f2NDePrSjjapBfkA==

using jwt.io (demo page), the signature is valid ....(SECRET : $kiMhduejNj0uTu1N914)

but, when i use this, its Invalid

jwt.verify(above_token, SECRET, function(err, decoded) {

      if(err){
        console.log(err);
        console.log(decoded);
        return res.status(401).json({status:401,msg:"Invalid signature"});        
      }

       console.log("Token Pass");
       next();

 });

@jfromaniello

Thanks

[jfromaniello]

@codetrash this is not a valid json despite what jwt.io says. First because it has invalid characters.

I think the main problem is that whoever generated this token used Base64, but the standard says it should be "base64url encoded" which is not exactly the same:

https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-32

here is an example in javascript:

https://github.com/brianloveswords/base64url/blob/master/index.js#L1-L8