Uses non-recommended authentication scheme

passport-jwt’s ExtractJwt.fromAuthHeader() uses the following http header:

Authorization: JWT JSON_WEB_TOKEN_STRING.....

But RFC 6750 clearly specifies that access token based authentication must use Bearer as the authentication token. The non-recommended scheme specification would lead to conflicts.

[akoskm]

For the sake of completeness, the code for the rfc6750 variant goes like this:

jwtOptions.jwtFromRequest = ExtractJwt.fromAuthHeaderWithScheme('Bearer');

use this with the example provided in https://github.com/themikenicholson/passport-jwt#configure-strategy.

Thanks @themikenicholson for putting this together! 🍾

[mikenicholson]

@JemiloII Authorization headers typically contain an authentication scheme along with the token or auth parameter. I think it was RFC 2617. I’m going to stick with the RFC compliant behavior.

If you don’t like the standard behavior you can write your own extractor function.