From 412ac3312b8325bc7afa0bc32c98f0604dea687d Mon Sep 17 00:00:00 2001 From: Rushi Gandhi Date: Wed, 16 Oct 2024 19:21:22 +0530 Subject: [PATCH] use jwt.verify instead of jwt.decoded to verify authenticity of token --- Server/middleware/verifyJWT.js | 14 +++++++++++++- Server/utils/messages.js | 3 +++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/Server/middleware/verifyJWT.js b/Server/middleware/verifyJWT.js index 53d0ea90a..90d8e1238 100644 --- a/Server/middleware/verifyJWT.js +++ b/Server/middleware/verifyJWT.js @@ -96,7 +96,19 @@ const verifyRefreshToken = (req, res, next) => { } // Authenticity of refreshToken is verified, now we can decode jwtToken for payload - req.user = jwt.decode(jwtToken); + const jwtSecret = req.settingsService.getSettings().jwtSecret; + const decoded = jwt.verify(jwtToken, jwtSecret, { ignoreExpiration: true }); + + if (!decoded) { + const error = new Error(errorMessages.INVALID_PAYLOAD); + error.status = 401; + error.service = SERVICE_NAME; + error.method = "verifyRefreshToken"; + next(error); + return; + } + + req.user = decoded; next(); }); } catch (error) { diff --git a/Server/utils/messages.js b/Server/utils/messages.js index 8cb7325fd..b29f806e7 100644 --- a/Server/utils/messages.js +++ b/Server/utils/messages.js @@ -17,6 +17,9 @@ const errorMessages = { INVALID_REFRESH_TOKEN: "Invalid refresh token", EXPIRED_REFRESH_TOKEN: "Refresh token expired", + //Payload + INVALID_PAYLOAD: "Invalid payload", + //Ownership Middleware VERIFY_OWNER_NOT_FOUND: "Document not found", VERIFY_OWNER_UNAUTHORIZED: "Unauthorized access",