freeCodeCamp / freeCodeCamp/back-end-development-and-apis

JWT admin-route test fails with quoted secrets or inline comments

Open Beginner friendly
#52 2 comments 0 reactions 0 assignees View on GitHub
PR in works
Dominant language
JavaScript
Stars
32
Forks
217
Avg merge
2d 12h
Merged PRs (30d)
6

Description

Step 35 of Build JWT Protected Routes rejects the reference solution when `JWT_SECRET` in `.env` is quoted or followed by an inline comment.

The [admin-route test](https://github.com/freeCodeCamp/back-end-development-and-apis/blob/4aa3fa848854a02c4ca1b2f7d34bd44fdb2f0a7a/curriculum/locales/english/build-jwt-protected-routes.md#L2254-L2300) parses `.env` by splitting lines at `=` and trimming whitespace. It retains quotes and inline comments, while the server's `node --env-file .env` removes them. The test therefore signs its admin token with a different secret from the server.

To reproduce:

1. Use the completed reference solution in `build-jwt-protected-routes/_solution` with its dependencies installed.
2. Set `.env` to:

```dotenv
PORT=8800
JWT_SECRET="repro-long-random-secret-799510"
```

3. Start the server with `npm start` and run the seven tests from step 35 against it.

Test 6 fails with `expected 401 to equal 200`; the other six pass. All seven should pass for the reference solution with this valid `.env` syntax.

Reproduced on Node v24.14.0 at commit `4aa3fa848854a02c4ca1b2f7d34bd44fdb2f0a7a`:

| Secret format | Result |
| --- | --- |
| Unquoted | All seven tests pass |
| Double-quoted | Only test 6 fails with 401 |
| Single-quoted | Only test 6 fails with 401 |
| Unquoted with an inline comment | Only test 6 fails with 401 |

Replacing the custom parser with `util.parseEnv(__env).JWT_SECRET` in the reproduction makes all seven tests pass with a double-quoted secret.

Investigated after [this forum report](https://forum.freecodecamp.org/t/build-jwt-protected-routes-build-jwt-protected-routes/799510). The post does not include `.env`, so the cause of that camper's failure is unconfirmed; the test defect is independently reproducible with the reference solution.

Contributor guide

Open the contributing guide

Research direction

Start with Step 35 in curriculum/locales/english/build-jwt-protected-routes.md, especially the admin-route test linked in the issue, and compare its .env parsing with Node's util.parseEnv behavior. Verify the test uses the same secret as the server for quoted values and inline comments, then run all seven tests against the reference solution; all should pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
testing-qa
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
85/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.