Code Quiz

JWT Token Verification Middleware

Spot the authentication bug in a JWT verification middleware that trusts tokens without checking signatures.

Codejavascript

const jwt = require('jsonwebtoken');

function authenticate(req, res, next) {
  const header = req.headers.authorization;
  if (!header) return res.status(401).json({ error: 'No token' });

  const token = header.split(' ')[1];

  try {
    // Read the user identity from the token
    const payload = jwt.decode(token);
    req.user = payload;
    next();
  } catch (err) {
    return res.status(401).json({ error: 'Invalid token' });
  }
}

module.exports = authenticate;

What is the security bug in this JWT authentication middleware?

Next →AuthN vs AuthZ and JWT Sessions