@clerk/backend: decodeJwt throws a raw SyntaxError for a malformed token

[ollipa]

Preliminary Checks

• I have reviewed the documentation: https://clerk.com/docs

• I have searched for existing issues: https://github.com/clerk/javascript/issues

• I have not already reached out to Clerk support via email or Discord (if you have, no need to open an issue here)

• This issue is not a question, general help request, or anything other than a bug report directly related to Clerk. Please ask questions in our Discord community: https://clerk.com/discord.

Reproduction

Publishable key

Description

decodeJwt throws a plain SyntaxError if a token has three segments but they're not valid base64url. It should throw a TokenVerificationError like it does for other bad tokens.

curl -i -H 'Authorization: Bearer aaa.bbb.ccc' https://example.com/

Steps to reproduce:

const { decodeJwt } = require('@clerk/backend/jwt')

decodeJwt('aaa.bbb.ccc')

Expected behavior:

TokenVerificationError, which is what you get from decodeJwt('aaaa.bbbb') or decodeJwt('notajwt').

Actual behavior:

Throws SyntaxError: Unexpected end of data.

decodeJwt checks that there are three parts, but the base64url.parse and JSON.parse calls right after that check aren't wrapped in anything. decodeJwt('YWJj.YWJj.YWJj') hits the JSON.parse one and throws SyntaxError: Unexpected token 'a', "abc" is not valid JSON.

Environment

- @clerk/backend 3.13.2

[wobsoriano]

Thanks for reporting!