JWT Webtoken Unable to verify against req.params-CodePudding

I've created an email authentication system, however there appears to be an issue with how I jwt.verify this token.

I believe there's an issue with my : process.env.PASS_SEC, which is just my Mongo.DB password secret. Is this correct? I can confirm if I do a res.sent(req.params.token), my token comes through fine, for example in this. eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjYyZjc0MWU3ZjBkZjZkY2IyZjM0ZDc3ZSIsImlhdCI6MTY2MDM3MTQzMSwiZXhwIjoxNjYwNjMwNjMxfQ.vFtdRzEH2_52Hdhxs84bk7RPdIRDIoZ6Rcd-zZoBhus

As such, I believe it's the SECRET is being passed incorrectly.

My current functioning code is:

router.post("/register", async (req, res, EMAIL_SECRET) => {
  const newUser = new User({
    fullname: req.body.fullname,
    email: req.body.email,
    position: req.body.position,
    username: req.body.fullname,

    password: CryptoJS.AES.encrypt(
      req.body.password,
      process.env.PASS_SEC
    ).toString(),
  });
  const accessToken = jwt.sign(
    {
      id: newUser._id, 
    },
     process.env.JWT_SEC,
    {
      expiresIn:"3d"
    },
    );

  const url = `http://localhost:5000/api/auth/confirmation/${accessToken}`;

  const  mailOptions = {
    from: '[email protected]',
    to: req.body.email,
    subject: 'Confirm Email',
    html: `Please click this email to confirm your email: <a href="${url}">${url}</a>`
  };

  transporter.sendMail(mailOptions, function(error, info){
    if (error) {
      console.log(error);
    } else {
      console.log('Email sent: '   info.response);
    }
  });


  try {
    const savedUser = await newUser.save();
    res.status(201).json(savedUser);
  } catch (err) {
    res.status(500).json(err);
  }
});

Which sends a code fine, however it does not appear to be correct, how would you create an EMAIL_SECRET?

This is how I wish to validate the email.

  //User Email Auth Login
  //Not yet functioning
  router.get('/confirmation/:token', async (req, res) => {
    try {
      //verify the token with the secret
      const { _id: { _id } } = jwt.verify(req.params.token, process.env.PASS_SEC);
        await models.User.update({ confirmed: true }, { where: { _id } });
    } catch (e) {
      res.send('This isnt working');
    }

  });

However, I cannot get to verify, whats wrong with secret

CodePudding user response：

You signed your token with process.env.JWT_SEC, you should verify it using the same key:

const { _id } = jwt.verify(req.params.token, process.env.JWT_SEC);

Also, you should be able to update your User with findByIdAndUpdate:

await User.findByIdAndUpdate(_id, { confirmed: true });