How to Handle JWT in Node.js: Fixes and Best Practices

To handle JWT in Node.js, use the jsonwebtoken library to create, verify, and decode tokens securely. Always verify tokens on protected routes and handle errors gracefully to avoid security issues.

Why This Happens

Many beginners try to use JWT in Node.js without properly verifying tokens or handling errors, which causes authentication failures or crashes. A common mistake is to decode tokens without verification, leading to security risks.

javascript

import jwt from 'jsonwebtoken';

const token = jwt.sign({ userId: 123 }, 'secretkey');

// Broken: decoding without verification
const decoded = jwt.decode(token);
console.log(decoded);

// No verification step here

Output

{ userId: 123, iat: 1680000000 }

The Fix

Use jwt.verify() to check the token's signature and validity before trusting its content. This prevents accepting tampered tokens and ensures secure authentication.

javascript

import jwt from 'jsonwebtoken';

const secretKey = 'secretkey';
const token = jwt.sign({ userId: 123 }, secretKey, { expiresIn: '1h' });

try {
  const verified = jwt.verify(token, secretKey);
  console.log('Verified payload:', verified);
} catch (error) {
  console.error('Token verification failed:', error.message);
}

Output

Verified payload: { userId: 123, iat: 1680000000, exp: 1680003600 }

Prevention

Always verify JWTs on every protected route using middleware. Use environment variables for secret keys and set token expiration times. Handle errors to avoid crashes and use HTTPS to protect tokens in transit.

Related Errors

Common errors include JsonWebTokenError when the token is malformed or signature is invalid, and TokenExpiredError when the token is past its expiration. Fix these by proper error handling and token renewal strategies.

Key Takeaways

Always verify JWT tokens with jwt.verify() before trusting their data.

Use environment variables to store secret keys securely.

Set token expiration to limit risk from stolen tokens.

Handle verification errors to prevent app crashes.

Use HTTPS to protect tokens during network transmission.