Unable to verify tokens when using bas64 encoded secrets about jwt

[kamilmysliwiec]

Thanks for reporting! Would you like to create a PR for this issue?

[EJMason]

@kamilmysliwiec Sure thing! Did you envision anything other than removing the toString call? My plan was to remove it and add some unit tests. Was the toString motivated by any edge case that I could also address in the PR?

[EJMason]

@kamilmysliwiec Also, one more thing. Looks like there is a method overload in the jsonwebtoken library that allows users to pass a callback instead of a private key as a second parameter for the verify method. This enables the ability to fetch keys from an external source instead of keeping them in state.

// Verify using getKey callback
// Example uses https://github.com/auth0/node-jwks-rsa as a way to fetch the keys.
var jwksClient = require('jwks-rsa');
var client = jwksClient({
  jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json'
});
function getKey(header, callback){
  client.getSigningKey(header.kid, function(err, key) {
    var signingKey = key.publicKey || key.rsaPublicKey;
    callback(null, signingKey);
  });
}

jwt.verify(token, getKey, options, function(err, decoded) {
  console.log(decoded.foo) // bar
});

Check out the typescript definitions for the 2 overloads:

/**
 * Asynchronously verify given token using a secret or a public key to get a decoded token
 * token - JWT string to verify
 * secretOrPublicKey - A string or buffer containing either the secret for HMAC algorithms,
 * or the PEM encoded public key for RSA and ECDSA. If jwt.verify is called asynchronous,
 * secretOrPublicKey can be a function that should fetch the secret or public key
 * [options] - Options for the verification
 * callback - Callback to get the decoded token on
 */
export function verify(
    token: string,
    secretOrPublicKey: string | Buffer | GetPublicKeyOrSecret,
    callback?: VerifyCallback,
): void;
export function verify(
    token: string,
    secretOrPublicKey: string | Buffer | GetPublicKeyOrSecret,
    options?: VerifyOptions,
    callback?: VerifyCallback,
): void;

And here is the type for the GetPublicKeyOrSecret

export type GetPublicKeyOrSecret = (
    header: JwtHeader,
    callback: SigningKeyCallback
) => void;

This functionality didn't exist in the Nestjs/jwt package, but might be worth calling out in the docs that you currently can't do this. In the future this could be an added feature that can simplify this behavior using the nest api. Food for thought.... 🤔

[kamilmysliwiec]

Fixed in 6.1.2