CODEWITHSUNDEEP
node.jsexpressmodel-view-controllerjwtmiddleware
Waifu_Forever
Waifu_Forever

Reputation: 107

Is a good idea pass decoded jwt data via express req parameters?

In my NodeJs application im using jwt to manage the user session, inside a jwt token i store user_role and user_id. This is my route:

 routes.post('/manga/post', Authorize("Scan"), MangaMiddleware.valid_manga_store, MangaController.store);

In the middleware Authorize("Scan") I verify the jwt token with "jwt.verify", if its valid i going to check if there is a active user with the token id and if his permission allow him to access this route, if so i use next()

In MangaController.store i going to save a new manga, and i need to save in the document the user_id who made the request.

That's my point, i already decoded the token in Authorize middleware but the decoded data do not persist out of the middleware. To access the user_id from MangaController i have to verify the token again.

I think i should avoid verify the same token twice, so in the middleware Authorize after verifying i was saving the user_id (encrypted) inside req.auth and after use it in the controller, i was setting req.auth = null. This way the user_id is stored in req.auth for a short period of time.

req.auth = user_id //after encrypting

My friend told me this is a bad idea storing decoded data inside req parameters, but i don't think it is this bad.

In a nutshell. Do i need to verify the token twice? Is there another way to retrieve this data? It is that bad storing decoded data in req parameters? I do appreciate your time and help.

Upvotes: 0

Views: 2005

Answers (1)

Manpreet Krishan
Manpreet Krishan

Reputation: 357

Verifying and decoding JWT are two different things. When you verify, it's checking for its integrity, ie making sure it has not been tampered with, while decoding JWT means converting from base64 to readable format (UTF-8?). So it doesn't have to be verified twice.

Assuming you sent your token in headers as "token":"base64encodedJwt", then after successful verification, whenever you need user_id, you can then simply decode the JWT. Use some JWT decode library.

    let token = req.get('token') || req.headers['token'];
    let payload = decodeJWT(token);
    let userId = payload.user_id;

If you are not storing it in req object, then you will have to decode it everytime you need it. So req.auth = userId should be fine.

Upvotes: 1

Related Questions