Why is my Jwt token not being extracted? - express

Question

I'm new to passport JWT and have this code sending post request from client:
export function checkLogin() {
return function( dispatch ) {
//check if user has token
let token = localStorage.getItem('token');
if (token != undefined) {
//fetch user deets
var config = {
headers: {'authorization': token, 'content-type': 'application/json'}
};
axios.post(`${API_URL}/login`, null, config)
.then(response => {
console.log('response is:', response);
})
.catch((error)=> {
console.log(error);
});
}
//user is anonymous
}
and this request is sending off fine with token in headers like so:
Accept:application/json, text/plain, */*
Accept-Encoding:gzip, deflate
Accept-Language:en-US,en;q=0.8
authorization:eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE0NzIzMTg2MDE5NTd9.SsCYqK09xokzGHEVFiHtHmq5_HvtWkb8EjQJzwR937M
Connection:keep-alive
Content-Length:0
Content-Type:application/json
DNT:1
Host:localhost:3090
Origin:http://localhost:8080
Referer:http://localhost:8080/
User-Agent:Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.23 Mobile Safari/537.36
On the server side, it is correctly routed through passport and hits this code:
// setup options for JWT strategy
const jwtOptions = {
jwtFromRequest: ExtractJwt.fromHeader('authorization'),
secretOrKey: config.secret,
ignoreExpiration: true
};
//create JWT strategy
const jwtLogin = new JwtStrategy(jwtOptions, function(payload, done ) {
console.log('payload:',payload); // --> payload: { iat: 1472318601957 }
// see if the user ID in the payload exists in our database
User.findById(payload.sub, function(err, user) {
if (err) {
console.log('auth error');
return done( err, false );
}
//if it does, call 'done' function with that user
if (user) {
console.log('user authd:', user);
done( null, user);
//otherwise, call 'done' function without a user object
} else {
console.log('unauthd user'); //--> gets here only
done( null, false);
}
});
});
The problem is that the extractJwt function only returns the iat portion and not the sub portion which I need to check the db. What am I doing wrong?

Answer 1

OK I figured it out. I examined how my token generator function was working. I'm using mongoose and it was passing the id of the user model to the token like this:
function tokenForUser(user) {
const timestamp = new Date().getTime();
//subject and issued at time
return jwt.encode({ sub: user.id, iat: timestamp }, config.secret);
}
I looked at the actual model that was being sent into this function and it turns out that mongoose adds an id with the key _id not id. Once I changed it to this everything works!
function tokenForUser(user) {
const timestamp = new Date().getTime();
//subject and issued at time
const userid = user['_id'];
return jwt.encode({ sub: userid, iat: timestamp }, config.secret);
}