Business
Jobs
  • About Us
  • Solutions
    • Job Postings
      Post your job and receive qualified candidates in 48h.
    • Candidate Assessments
      500+ technical and psychological tests, plus anti-fraud.
    • Headhunting
      Tailor-made executive search from start to finish.
    • Payroll + EOR
      Payroll dispersal and EOR across 15+ LATAM countries.
  • Pricing
  • Jobs

0

207
Views
Correct way to verify Jwt

I have written this code here

 jwt.verify(token.split(':')[1], 'testTest')

And i am trying verify this so it can return true and move on. The point the jwt is coming as a payload example

How can i verify this jwt so

`token.split(':')[1] can match testTest`
about 4 years ago · Juan Pablo Isaza
3 answers
Answer question

0

jwt.verify does not do that. It verifies the jwt with the secret or public key. If you don't want to verify it and just get the payload, what you want to do is decode the jwt, then retrieve the value and do string comparison.

let decoded = jwt.decode(token);
if(decoded.sub == "testTest")
{
    //Do your stuff...
}

You can read more about jwt in their github page

about 4 years ago · Juan Pablo Isaza Report

0

My approach is to keep the verify method to only verify that the token hasn't been modified:

jwt.verify(token, JWT_SECRET);

And use the decode method to get the payload:

const payload = jwt.decode(token, JWT_SECRET);

After that you can check your payload value

about 4 years ago · Juan Pablo Isaza Report

0

first important question - who is the token issuer?

And do you want to verify the token validity AND / OR just compare the content of the token to a given value?

verification (& decoding) is done with

var decoded = jwt.verify(token, '<public key for verification>');

if(decoded.sub == "<value to match>"){
// TODO: implement match case
}

(assuming you are using jsonwebtoken package)

You have to provide the public key for verification which is given by the token issuer.

If you want to test it properly, I propose to generate a token on jwt.io -> you can generate upfront a private/public key pair on your own and use it for encoding and verification before decoding.

It is also possible to just decode the token, but without the verification against the public key given by the issuer, anybody could send you tokens which will be quite unsave on your side.

Best wishes

about 4 years ago · Juan Pablo Isaza Report
Answer question
Find remote jobs

Discover the new way to find a job!

Top jobs
Top job categories
Business
Post vacancy Pricing Sales
Legal
Terms and conditions Privacy policy
© 2026 PeakU Inc. All Rights Reserved.
Andres GPT
Show me some job opportunities
There's an error!