Getting annoying logging with stacktrace.

If I send a request without any authorization token, express logs an error to the console.

UnauthorizedError: No authorization token was found
    at middleware (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express-jwt/lib/index.js:75:21)
    at Layer.handle [as handle_request] (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/layer.js:95:5)
    at trim_prefix (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:312:13)
    at /home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:280:7
    at Function.process_params (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:330:12)
    at next (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:271:10)
    at expressInit (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/middleware/init.js:33:5)
    at Layer.handle [as handle_request] (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/layer.js:95:5)
    at trim_prefix (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:312:13)
    at /home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:280:7
    at Function.process_params (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:330:12)
    at next (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:271:10)
    at query (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/middleware/query.js:44:5)
    at Layer.handle [as handle_request] (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/layer.js:95:5)
    at trim_prefix (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:312:13)
    at /home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:280:7
    at Function.process_params (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:330:12)
    at next (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:271:10)
    at Function.handle (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/router/index.js:176:3)
    at EventEmitter.handle (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/application.js:173:10)
    at Server.app (/home/levin/coding/satoshipay/nano-btc-vendor/server/node_modules/express/lib/express.js:38:9)
    at emitTwo (events.js:106:13)
    at Server.emit (events.js:191:7)
    at HTTPParser.parserOnIncoming [as onIncoming] (_http_server.js:546:12)
    at HTTPParser.parserOnHeadersComplete (_http_common.js:99:23)

The error itself is fine for me, I handle it in an appropiate middleware, but I do NOT want this stacktrace to be logged. I cannot find where to switch it off or which package is actually logging this stuff. I am also using express-jwt-authz and express-jwt-permissions

[jfromaniello]

@Levino you didn’t read my message here and you didn’t read the README file of the project. Again:

1. There is no console.log or anything like that in this project.
2. This is the default behavior of express.js.
3. If you want to change this default behavior, please follow the instructions on the readme: https://github.com/auth0/express-jwt#error-handling

For instance change your test to this:

const middleware = expressJwt({secret: 'geheim'})
app.use(middleware)
app.use(function (err, req, res, next) {
  if (err.name === 'UnauthorizedError') {
    res.status(401).send('invalid token');
  } else {
    next(err);
  }
});
return request(app).get('/').expect(401)

[cif]

Stack traces are definitely a security liability. Search for easy way to suppress landed me here. app.use(fn) chaining method used in docs which @jfromaniello references above didn’t work for me using express@4.16.2

However, when I ended up using middleware functions as arguments to app.get() it works as I was hoping for:

const HTTP_UNAUTHORIZED = 401
const handleUnauthorizedError = (err, req, res, next) => {
  if (err.status == HTTP_UNAUTHORIZED) {
    return res.status(HTTP_UNAUTHORIZED).send('')
  }
  next()
}
app.get(
  '/secure-endpoint',
  jwt({ secret: JWT_SECRET }),
  handleUnauthorizedError,
  (req, res) => {
    // do the things
  }
)

Hope that helps someone else. If maintainers like, I would be happy to submit a quick PR to update docs with the suggestion ✌️