I'm using express-jwt to control the user privileges of my startup project, but I'm getting an error when I try to request access (using Postman) an api that only the admin can access. This is my authJwt document:
import { expressjwt } from "express-jwt";
import dotenv from 'dotenv';
dotenv.config();
const secretJwt = process.env.JWT_SECRET;
function authJwt() {
return expressjwt({
secret: secretJwt,
algorithms: ['HS256'], //https://jwt.io/
isRevoked: isRevoked
})
.unless({
path:
[
'/users/login',
'/users/register',
{
url: /\/categories(.*)/, // (https://regex101.com/)
methods: ['GET', 'OPTIONS']
}
]
})
}
async function isRevoked(req, payload, done) {
if(!payload.isAdmin) {
done(null, true)
}
done();
}
export default authJwt;
The error I'm getting is:
TypeError: done is not a function<br> at Object.isRevoked (file:///C:/Users/OneDrive%20-%20GfK/Documents/IPCA/Programa%C3%A7%C3%A3o%20Web/PWeb%20-%20Projecto/FTA%20/backend/middlewares/jwt.js:42:9)<br> at C:\Users\\OneDrive - GfK\Documents\IPCA\Programação Web\PWeb - Projecto\FTA\backend\node_modules\express-jwt\dist\index.js:157:54<br> at step (C:\Users\rui.lopes\OneDrive - GfK\Documents\IPCA\Programação Web\PWeb - Projecto\FTA\backend\node_modules\express-jwt\dist\index.js:56:23)<br> at Object.next (C:\Users\rui.lopes\OneDrive - GfK\Documents\IPCA\Programação Web\PWeb - Projecto\FTA\backend\node_modules\express-jwt\dist\index.js:37:53)<br> at fulfilled (C:\Users\rui.lopes\OneDrive - GfK\Documents\IPCA\Programação Web\PWeb - Projecto\FTA\backend\node_modules\express-jwt\dist\index.js:28:58)<br> at processTicksAndRejections (node:internal/process/task_queues:96:5)
const {expressjwt: expressJwt} = require('express-jwt')
exports.authJwt = expressJwt ({ secret: secretJwt, algorithms: ['HS256'], //https://jwt.io/ isRevoked: isRevoked })....
As per updates: The isRevoked function had (req, payload, cb), now it can return a promise and receives (req, token). token has header and payload.
IsRevoked = (req: express.Request, token: jwt.Jwt | undefined) => Promise<boolean`>
this worked for me:
async function isRevoked(req, token){
if(!token.payload.isAdmin) {
return true;
}
}