I am a beginner with node js. I want to make an authentication server using jwt (jsonwebtoken). The problem is when I test my end point "/api/posts?authorisation=Bearer token..." in postman with method POST with the right token, it gives me forbidden. Here is my code:

const express = require('express')
const jwt = require('jsonwebtoken')

const app = express()

app.get("/api", (req, res) => {
    res.json({
        message: "Hey there!!!"
    })
})

app.post('/api/posts', verifyToken, (req, res) => {
    jwt.verify(req.token, "secretkey", (err, authData) => {
        if (err) {
            res.sendStatus(403) //forbidden
            res.send(`<h2>${err}</h2>`)
        } else {
            res.json({
                message: "Post Created...",
                authData
            })
        }
    })
})

app.post('/api/login', (req, res) => {
    const user = {
        id: 1,
        username: "John",
        email: "[email protected]"
    }
    jwt.sign({ user: user }, "secretkey", (err, token) => {
        res.json({
            token
        })
    })
})

function verifyToken(req, res, next) {
    const bearerHeader = req.headers["authorization"]
    if (typeof bearerHeader !== "undefined") {
        const bearerToken = bearerHeader.split(" ")[1]
        req.token = bearerToken
        next()
    } else {
        res.sendStatus(403) //forbidden
    }
}
app.listen(5000, () => {
    console.log("Server is running :)")
})

I expected it to work because I brought it from a tutorial.

CodePudding user response：

Your code works

The problem is in your request invocation:

According to the oauth2 spec, the Authorization token should be a header and your code expect that

So the token should be sent as http header, not as a query param like foo/bar?authorization=Bearer token...".

Here some samples

Postman

Axios (javascript)

let webApiUrl = 'example.com/getStuff';
let tokenStr = 'xxyyzz';
axios.get(webApiUrl, 
    { headers: { "Authorization": `Bearer ${tokenStr}` } });

Advice

• Read about oauth2 and jwt
• Perform the token validation in the middleware to avoid the validation on each route