Files
main.tsmain
What you'll learn
- Sign a token with sign(payload, secret) and read its three parts
- Guard routes with jwt({ secret, alg }) and read the verified claims from c.get('jwtPayload')
- Tell the refusals apart: no token, a token that fails verification, and a valid token whose claims are not enough
Press Run tests to start the app. Its log appears here.Graded endpoints
No user matches: no token is issued
sign({ sub, role, exp }, secret) with a fixed expiry gives the same token every time, which is what makes it gradeable
jwt() refuses with 401 and a challenge saying no authorization was included
Anything that fails verification, a made-up string, a bad signature, an expired token, is one refusal: invalid_token
Signed with the right secret but its exp is in the past: the same invalid_token
Verified: the handler answers the claims from c.get('jwtPayload')
A valid token whose role is keeper: the handler reads the claim and refuses with 403
Past the guard and the role check, the handler's 404
An admin's token: the cat is removed
Any valid token may read; Tom is gone