Passport JWT Strategy extracting options

user_7944610 0
Viewed 4408

Using Passport JWT Strategy, I'm passing the token down via params, and extracting the token like this ExtractJWT.fromUrlQueryParameter('secret_token').

But sometimes I'm passing the token down via header, I would like to extract it like this ExtractJWT.fromHeader('secret_token').

How can I check how its being passed down and use the correct extracting method dynamically.

This is my code:

passport.use(new JWTstrategy({
  secretOrKey: process.env.AUTH_SECRET,
  jwtFromRequest: ExtractJWT.fromUrlQueryParameter('secret_token')

}, async (token, done) => {
  try {
    //Pass the user details to the next middleware
    return done(null, token.user);
  } catch (error) {
    done(error);
  }
}));

Thank you! Im on this for a long time....

passport-local jwt passport.js node.js authentication
4 Answers

Use ExtractJwt.fromExtractors() method

var jwtStrategy = new JwtStrategy({
// this will try to extract from Query parm, header and Authheader
  jwtFromRequest: ExtractJwt.fromExtractors([ExtractJwt.fromUrlQueryParameter("secret_token"), ExtractJwt.fromHeader("secret_token"), ExtractJwt.fromAuthHeaderAsBearerToken()]),
//here we have defined all possible extractors in an array
  secretOrKey: process.env.AUTH_SECRET
}, async (payload, done) => {
  ...
});
user_105223830

The method has been added to extract token from header. Pass it as:

  • Authorization: Bearer {token}
  • Content-Type : application/json
jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken()
user_79301760

try this way :

const options = {};
options.jwtFromRequest = ExtractJWT.fromUrlQueryParameter('secret_token')!=undefined?ExtractJWT.fromUrlQueryParameter('secret_token'):ExtractJWT.fromHeader('secret_token');
options.secretOrKey = process.env.AUTH_SECRET;

passport.use(new JWTstrategy(options, async (token, done) => {
  try {
    //Pass the user details to the next middleware
    return done(null, token.user);
  } catch (error) {
    done(error);
  }
}));
user_69437620

Answer:

Here is a workaround...

It looks for query params or headers with the name secret_token .

var url = require('url');

const options = {};
options.jwtFromRequest = (request) => {
  var token = null;
  var param_name = 'secret_token' //parameter name 
  var parsed_url = url.parse(request.url, true);

  if (request.headers[param_name]) {
    token = request.headers[param_name];
  }
  else if (parsed_url.query && Object.prototype.hasOwnProperty.call(parsed_url.query, param_name)) {
    token = parsed_url.query[param_name];
  }
  return token;
}
options.secretOrKey = process.env.AUTH_SECRET;

passport.use(new JWTstrategy(options, async (token, done) => {
  try {
    //Pass the user details to the next middleware
    return done(null, token.user);
  } catch (error) {
    done(error);
  }
}));
user_79446100
Related