security: JWT token extraction missing Bearer scheme handling #8

New Issue

2026-06-17T15:05:23Z

abumahid commented

2026-06-17 15:05:23 +00:00

Description

The authentication middleware extracts tokens from the Authorization header but doesn't properly handle the standard "Bearer" scheme. It accepts any token in the header, and if a Bearer token is provided, it will pass the entire string "Bearer " to the JWT verification, causing verification to fail silently or with confusing errors.

Location

File: src/app/middlewares/auth.ts
Component: auth() middleware
Lines: 8-30

How to Fix

Extract and validate the Bearer token properly:

const auth = (...roles: Role[]) => {
  return async (req: Request, res: Response, next: NextFunction) => {
    try {
      let token = req.headers.authorization || req.cookies.access_token;
      
      // Handle Bearer scheme
      if (token && token.startsWith('Bearer ')) {
        token = token.slice(7); // Remove 'Bearer ' prefix
      }
      
      if (!token) {
        throw new AppError("You are not authorize!!", 401);
      }
      
      const verifiedUser = jwtHelpers.verifyToken(
        token,
        configs.jwt.access_token as string,
      );
      
      if (!roles.length || !roles.includes(verifiedUser.role)) {
        throw new AppError("You are not authorize!!", 401);
      }
      
      req.user = verifiedUser as JwtPayloadType;
      next();
    } catch (err) {
      next(err);
    }
  };
};

Acceptance Criteria

Bearer scheme tokens (with "Bearer " prefix) are properly parsed
Cookie tokens continue to work
Invalid Bearer tokens are rejected with 401
JWT verification works with extracted token
Build passes
Type check passes
Auth middleware accepts both Bearer and cookie tokens

### Description The authentication middleware extracts tokens from the Authorization header but doesn't properly handle the standard "Bearer" scheme. It accepts any token in the header, and if a Bearer token is provided, it will pass the entire string "Bearer <token>" to the JWT verification, causing verification to fail silently or with confusing errors. ### Location - **File:** `src/app/middlewares/auth.ts` - **Component:** `auth()` middleware - **Lines:** 8-30 ### How to Fix Extract and validate the Bearer token properly: ```typescript const auth = (...roles: Role[]) => { return async (req: Request, res: Response, next: NextFunction) => { try { let token = req.headers.authorization || req.cookies.access_token; // Handle Bearer scheme if (token && token.startsWith('Bearer ')) { token = token.slice(7); // Remove 'Bearer ' prefix } if (!token) { throw new AppError("You are not authorize!!", 401); } const verifiedUser = jwtHelpers.verifyToken( token, configs.jwt.access_token as string, ); if (!roles.length || !roles.includes(verifiedUser.role)) { throw new AppError("You are not authorize!!", 401); } req.user = verifiedUser as JwtPayloadType; next(); } catch (err) { next(err); } }; }; ``` ### Acceptance Criteria - [ ] Bearer scheme tokens (with "Bearer " prefix) are properly parsed - [ ] Cookie tokens continue to work - [ ] Invalid Bearer tokens are rejected with 401 - [ ] JWT verification works with extracted token - [ ] Build passes - [ ] Type check passes - [ ] Auth middleware accepts both Bearer and cookie tokens ---

abumahid added the security High labels 2026-06-17 15:05:23 +00:00

abumahid added this to the quicklanch-server project 2026-06-17 15:05:23 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: summer2026/quicklanch-server#8