Schema Custom Validation Fails Checking If Is JWT Token

I have a schema validation like this one:

token: {
        in: ['body', 'header'],
        isJWT: true,
        optional: false,
        custom: { 
             options: async (value, { req }) => { 
                     const token = req.body.token || req.headers.authentication&& req.headers.authentication.split(' ')[1]; // Authentication: Bearer {token}
                     const isValidJWT = validator.isJWT(token) // returns true
                     return canUseThisToken(token) // It's a boolean method from app, works
             }
        },
       errorMessage: 'The token is invalid'
}

The problem is I noticed the isJWT from schema does not validates correctly the token when it comes from the body, but not when it comes from the header. And I receive the error message. But the token is valid, using the same validation lib.

Once I remove the isJWT from the schema validation, it works well.

[gustavohenke]

Ah. So the token would need to be valid everywhere it is present. This is a security measure – see #331 for context.

So you seem to be doing some parsing to the token when it come from headers: Bearer {token}.

This is not valid JWT. One option is to omit it from either req.body or req.headers. Or, you could use a custom sanitiser to split the value before it’s validated:

token: {
	in: ['body', 'headers'],
	customSanitizer: {
		options: (value, { location }) => {
			return location === 'headers' ? value.split(' ')[1] : value;
		}
	},
	isJWT: true,
}

Hope it helps 😃

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.