`UnauthorizedError: jwt expired` being thrown with `credentialsRequired: false`

[lorensr]

I believe that according to https://github.com/auth0/express-jwt/pull/47 I should not get this error?

UnauthorizedError: jwt expired
    at /Users/me/gh/api-model/node_modules/express-jwt/lib/index.js:102:22
    at /Users/me/gh/api-model/node_modules/jsonwebtoken/verify.js:27:18

Code:

import jwt from 'express-jwt'

expressApp.use(
  '/graphql',
  jwt({
    ...
    credentialsRequired: false
  }),
  ...
)

Version: "express-jwt": "^5.3.0",

[bearfact]

👍

[devansvd]

Having a same problem unable use the custom error handling it always return jwt expired

[SimonStiph]

@Vanthiyadevan that didn't work for me, and I don't think that the order of parameters should matter in any reasonable context.

This issue is pretty straightforward: In most circumstances, it's logically disjointed to allow the forward sequence of a request without credentials, yet deny a request that has expired credentials.

Therefore an option to allow the forward sequence of a request with expired credentials should be included; that has the added benefit of not breaking any apps that might now rely on the current behavior.

[karellodewijk]

The behavior was changed, caught me by surprise to. When the token is invalid it will now go to the error handler even if {credentialsRequired: false} is set. It used to be that it just continued as an unauthenticated user.

You can go back to the previous behavior by eating the error like so:

var ejwt = require('express-jwt');
app.use(ejwt({secret: config.app.secret, credentialsRequired: false}), function (err, req, res, next) {
  if (err.code === 'invalid_token') return next();
  return next(err);
});

[pie6k]

@karellodewijk solution seems to work, but it's weird to create custom error handlers while credentialsRequired is set to false.

[paulbuying]

@karellodewijk I think the e in next(e) should be err.

[iamchathu]

Any update on this?

[nolandg]

This is rather counter-intuitive behaviour. I would expect all failures of the token to be silent if credentialsRequired: false is set.

[rebolyte]

To work around this I ended up creating a separate middleware for my routes that needed to allow an expired token, and including the ignoreExpiration option that gets passed along to jsonwebtoken here:

expressJwt({
  secret: process.env.JWT_SECRET,
  credentialsRequired: false,
  ignoreExpiration: true
});