`UnauthorizedError: jwt expired` being thrown with `credentialsRequired: false`

I believe that according to https://github.com/auth0/express-jwt/pull/47 I should not get this error?

UnauthorizedError: jwt expired
    at /Users/me/gh/api-model/node_modules/express-jwt/lib/index.js:102:22
    at /Users/me/gh/api-model/node_modules/jsonwebtoken/verify.js:27:18

Code:

import jwt from 'express-jwt'

expressApp.use(
  '/graphql',
  jwt({
    ...
    credentialsRequired: false
  }),
  ...
)

Version: "express-jwt": "^5.3.0",

[karellodewijk]

The behavior was changed, caught me by surprise to. When the token is invalid it will now go to the error handler even if {credentialsRequired: false} is set. It used to be that it just continued as an unauthenticated user.

You can go back to the previous behavior by eating the error like so:

var ejwt = require('express-jwt');
app.use(ejwt({secret: config.app.secret, credentialsRequired: false}), function (err, req, res, next) {
  if (err.code === 'invalid_token') return next();
  return next(err);
});

[pie6k]

@karellodewijk solution seems to work, but it’s weird to create custom error handlers while credentialsRequired is set to false.