How can I verify the authjs.session-token from next-auth v5 on a nestjs server?
Unanswered
Prairie yellowjacket posted this in #help-forum
Prairie yellowjacketOP
I want to verify token that next auth returns:
eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoibXZzMjNVM0RvYnlwbFpTcXd0bGhVbVRXQk1UYnI0WjNtR3lEUkVHdXNhdVlXd3VjenNkM3hZRnF5eVlGWVljb0hXMDJzM1U0VzVlb3JZZ21YT0lQZkEifQ..R12Q0WultgDX3PTeB2BVpg.ou-y8zvgZdu2pmaqPjykxwR_veYuMygwm7nQsCvLDqphWxJ5PoN2DSD2W2rjGLGyWXUGCfvcuA63kmpcYV79MeBky1ViqJ3GE-i__eAybYsr4ccFSEPE5FPAEmnxSyjb6m17ZDazDifbsgED9s4zJ28_09gYyv4rdLJX9T2J4fyyhYT270DCF_X4JbRlm7hSNsP9a2kvlsA8MilZ1Ol9ooAuab1124WveML8jKqMxJlB5RyZ2aB8XeT1KxEXdfyr47nHEuwSuzrUgM-xRtTtiUwOvRjPrI2y2MR5l2bbcMYo_T-21ByLNAA4pX5pih_6.kh_MsZIK3cTyQ-9fARPrLTk1kCNqMzMfQYAql5nO_jg
but all I get in return is "jwt malformed" as an error. I don't know how does next auth decrypt function works which algorithm it uses. I tried to verify it on jwt.io but same problem
eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoibXZzMjNVM0RvYnlwbFpTcXd0bGhVbVRXQk1UYnI0WjNtR3lEUkVHdXNhdVlXd3VjenNkM3hZRnF5eVlGWVljb0hXMDJzM1U0VzVlb3JZZ21YT0lQZkEifQ..R12Q0WultgDX3PTeB2BVpg.ou-y8zvgZdu2pmaqPjykxwR_veYuMygwm7nQsCvLDqphWxJ5PoN2DSD2W2rjGLGyWXUGCfvcuA63kmpcYV79MeBky1ViqJ3GE-i__eAybYsr4ccFSEPE5FPAEmnxSyjb6m17ZDazDifbsgED9s4zJ28_09gYyv4rdLJX9T2J4fyyhYT270DCF_X4JbRlm7hSNsP9a2kvlsA8MilZ1Ol9ooAuab1124WveML8jKqMxJlB5RyZ2aB8XeT1KxEXdfyr47nHEuwSuzrUgM-xRtTtiUwOvRjPrI2y2MR5l2bbcMYo_T-21ByLNAA4pX5pih_6.kh_MsZIK3cTyQ-9fARPrLTk1kCNqMzMfQYAql5nO_jg
headers: {
'Content-Type': 'application/json',
authorization: `bearer ${session.user.access_token}`,
email: session.user.email
}
const request = context.switchToHttp().getRequest();
const token = this.extractTokenFromHeader(request);
if (!token) {
throw new UnauthorizedException();
}
const payload = await this.jwtService.verifyAsync(token, {
secret: 'WMLeoaOTccHbSjInqE/DCaHK02TCfx06XXXG9ujhzkM=',
algorithms: ['HS512'],
});but all I get in return is "jwt malformed" as an error. I don't know how does next auth decrypt function works which algorithm it uses. I tried to verify it on jwt.io but same problem
4 Replies
You could use middleware for the route you want to protect
Also, don't send a token string here.
Prairie yellowjacketOP
I want to protect external backend api route
@<Milind ツ /> Also, don't send a token string here.
Prairie yellowjacketOP
this is test data, not a real token or secret