Bug: Can't use multiple secrets with different algorithms

Description Using a function with the secret option to express-jwt, I can provide different secrets for different requests. These secrets might require different algorithms to verify, e.g. HS256 and RS256.

This doesn’t work as expected: After one token has been verified by a middleware, only tokens with the same algorithm can be verified by that middleware. Verification of tokens with different algorithms fails with UnauthorizedError: invalid algorithm. See https://gist.github.com/bspot/319dd8c5458d24955842b400bd90b634 for a test case.

Reason

1. The options argument to express-jwt is passed to jwt.verify on every request. (https://github.com/auth0/express-jwt/blob/master/lib/index.js#L99)
2. As long as options.algorithms is empty, jsonwebtoken fills it with the list of applicable algorithms. (https://github.com/auth0/node-jsonwebtoken/blob/v6.2.0/index.js#L89)
3. On subsequent requests, options.algorithms is filled and jsonwebtoken refuses to use any other algorithm.

Workaround Keep a reference to the options passed to express-jwt and

delete options.algorithms;

before each request. This can be done in the function passed as the secret.

Potential fix

1. Either delete options.algorithms; in the express-jwt middleware on every request, or
2. pass Object.assign({}, options) to jwt.verify.

[jfromaniello]

Updated jsonwebtoken in v5.3.0

[gillesdemey]

A workaround that worked for us is to create a new options object to pass to the JWT middleware on each request

const jwt = require('express-jwt')

function checkJWT (req, res, next) {    
  const options = Object.assign({}, { secret: getSecret })
  jwt(options)(req, res, next)
}

function getSecret (req, payload, callback) {
  return callback(null, 'some shared secret or RSA public key')
}