fastify / fastify/fastify-jwt

Unable to set key override on request.jwtVerify

Open
#346 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
586
Forks
120
PR merge metrics
No merged PRs in 30d

Description

### Prerequisites

- [X] I have written a descriptive issue title
- [X] I have searched existing issues to ensure the bug has not already been reported

### Fastify version

4.27.0

### Plugin version

8.0.1

### Node.js version

20.13.1

### Operating system

Linux

### Operating system version (i.e. 20.04, 11.3, 10)

alpine3.18

### Description

I am unable to set a custom secret key for jwt tokens when calling
`request.jwtVerify({decode: {}, verify: { key: 'override' }})`

The verify function still expects the key to be the same as set when registering `fastifyJwt` to `fastify`.

Example code:
```
fastify.register(fastifyJwt, {
secret: 'hunter2'
}
...
fastify.get('/verify', function (request, reply) {
const jwt = await request.jwtVerify({decode: {}, verify: {key: 'override'}})
}
```
Above request fails when signing the JWT token with `override`, the original secret works.

Using the debugger I can see the override key is passed to jwt.js, however it is never set in `const verifierOptions = mergeOptionsWithKey(options.verify || options, secretOrPublicKey)`.

### Link to code that reproduces the bug

_No response_

### Expected Behavior

One would expect that `request.jwtVerify({decode: {}, verify: { key: 'override' }})` will use the key specified in options.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.