error always null when using custom callback

The code I have, (the signature is from http://passportjs.org/docs/authenticate)

passport.authenticate('jwt', { session: false }, (err, user, info) => {
    if (err) {
      return next(err); 
    }
    if (!user) {
      return next(AuthenticationError(401, info));
    }
    req.user = user;
    return next();
  })(req, res, next);

However, in the case of malformed jwt or expired jwt, the err object is always null while the info object is carrying the error information. Is this designed on purpose or should be a bug?

[LukeAskew]

This was pretty confusing for me. If an expired or invalid token is not an exception, what is?

Here’s the middleware I ended up with.

function authenticate() {
  return (req, res, next) => {
    passport.authenticate('jwt', (err, data, info) => {
      if (err || info) {
        next(new Error('Unauthorized.'));
      } else {
        next();
      }
    })(req, res, next);
  };
}

[mikenicholson]

@LukeAskew I wrote this module using passport-local as a model.

In passport-local, which was written by the author of the passport framework, failure to authenticate is not treated as an exception. Instead, invalid credentials results in the strategy calling self.fail() (which populates info). I treat expired or invalid JWT’s the same way the passport-local strategy would treat an incorrect password or a non-existent user.

Based on my understanding of passport-local, only things like database errors, etc. result in exceptions. To me this makes sense since exceptions should be reserved for unexpected errors. Invalid auth credentials are an expected case for an authentication framework and not treated as an exception by this module or passport-local.