JWT token verification middleware in Express - Step-by-Step Execution

Concept Flow - JWT token verification middleware

Incoming HTTP Request

↓

Check for Authorization Header

Yes / No↓

Extract JWT

↓

Verify JWT Signature

↓

Attach User Info

↓

Call Next Middleware/Route Handler

The middleware checks the request for a JWT token, verifies it, and either attaches user info and continues or rejects the request.

Execution Sample

Express

function verifyToken(req, res, next) {
  const token = req.headers['authorization']?.split(' ')[1];
  if (!token) return res.status(401).send('No token');
  jwt.verify(token, secret, (err, user) => {
    if (err) return res.status(401).send('Invalid token');
    req.user = user;
    next();
  });
}

This middleware extracts a JWT from the Authorization header, verifies it, and either rejects or passes control with user info.

Execution Table

Step	Action	Token Extracted	Verification Result	Request User Attached	Response Sent	Next Called
1	Check Authorization header	Bearer abc.def.ghi	N/A	No	No	No
2	Extract token from header	abc.def.ghi	N/A	No	No	No
3	Verify token signature	abc.def.ghi	Valid	No	No	No
4	Attach user info to req	abc.def.ghi	Valid	Yes	No	No
5	Call next middleware	abc.def.ghi	Valid	Yes	No	Yes
6	Request proceeds to next handler	abc.def.ghi	Valid	Yes	No	Yes

💡 Middleware ends after calling next() if token is valid; otherwise, sends 401 response.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
req.headers['authorization']	Bearer abc.def.ghi	Bearer abc.def.ghi	Bearer abc.def.ghi	Bearer abc.def.ghi	Bearer abc.def.ghi	Bearer abc.def.ghi
token	undefined	undefined	abc.def.ghi	abc.def.ghi	abc.def.ghi	abc.def.ghi
verification error (err)	undefined	undefined	undefined	null	null	null
user (decoded token)	undefined	undefined	undefined	{id:123}	{id:123}	{id:123}
req.user	undefined	undefined	undefined	undefined	{id:123}	{id:123}

Key Moments - 3 Insights

Why does the middleware send a 401 response if the token is missing?

Because if no token is extracted, the middleware immediately sends a 401 response to reject unauthorized access.

What happens if the token verification fails?

If verification returns an error, the middleware sends a 401 response and does not call next(), stopping further processing.

How does the middleware pass user info to later handlers?

In step 4, the middleware attaches the decoded user info to req.user, so subsequent middleware or routes can access it.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of 'token' after Step 2?

A undefined

B "Bearer abc.def.ghi"

C "abc.def.ghi"

D null

💡 Hint

Check the 'Token Extracted' column in row for Step 2.

At which step does the middleware attach user info to the request object?

A Step 4

B Step 2

C Step 3

D Step 5

💡 Hint

Look at the 'Request User Attached' column in execution_table.

If the token is invalid, what will the middleware do according to the execution flow?

A Attach user info and call next()

B Send 401 Unauthorized response

C Ignore and call next()

D Send 200 OK response

💡 Hint

Refer to the concept_flow and execution_table step 3 for invalid verification.

Concept Snapshot

JWT Verification Middleware in Express:
- Extract token from Authorization header
- If missing, send 401 Unauthorized
- Verify token signature with secret
- If invalid, send 401 Unauthorized
- If valid, attach decoded user info to req.user
- Call next() to continue processing

Full Transcript

This middleware runs on each incoming HTTP request. It first looks for the Authorization header. If the header is missing or does not contain a token, it immediately sends a 401 Unauthorized response. If a token is found, it verifies the token's signature using a secret key. If verification fails, it sends a 401 Unauthorized response. If verification succeeds, it attaches the decoded user information to the request object as req.user. Finally, it calls next() to pass control to the next middleware or route handler. This ensures only requests with valid tokens proceed.