use jwt.verify instead of jwt.decoded to verify authenticity of token

Server/middleware/verifyJWT.js

@@ -96,7 +96,19 @@ const verifyRefreshToken = (req, res, next) => {
       }
 
       // Authenticity of refreshToken is verified, now we can decode jwtToken for payload
-      req.user = jwt.decode(jwtToken);
+      const jwtSecret = req.settingsService.getSettings().jwtSecret;
+      const decoded = jwt.verify(jwtToken, jwtSecret, { ignoreExpiration: true });
+
+      if (!decoded) {
+        const error = new Error(errorMessages.INVALID_PAYLOAD);
+        error.status = 401;
+        error.service = SERVICE_NAME;
+        error.method = "verifyRefreshToken";
+        next(error);
+        return;
+      }
+
+      req.user = decoded;
       next();
     });
   } catch (error) {

Server/utils/messages.js

@@ -17,6 +17,9 @@ const errorMessages = {
   INVALID_REFRESH_TOKEN: "Invalid refresh token",
   EXPIRED_REFRESH_TOKEN: "Refresh token expired",
 
+  //Payload
+  INVALID_PAYLOAD: "Invalid payload",
+
   //Ownership Middleware
   VERIFY_OWNER_NOT_FOUND: "Document not found",
   VERIFY_OWNER_UNAUTHORIZED: "Unauthorized access",