express-jwt - npm Package Compare versions

Comparing version 3.0.0 to 3.0.1

lib/index.js

@@ -85,10 +85,15 @@ var jwt = require('jsonwebtoken');
 
-    var payload = jwt.decode(token);
+    var dtoken = jwt.decode(token, { complete: true }) || {};
 
     async.parallel([
       function(callback){
-        secretCallback(req, payload, callback);
+        var arity = secretCallback.length;
+        if (arity == 4) {
+          secretCallback(req, dtoken.header, dtoken.payload, callback);
+        } else { // arity == 3
+          secretCallback(req, dtoken.payload, callback);
+        }
       },
       function(callback){
-        isRevokedCallback(req, payload, callback);
+        isRevokedCallback(req, dtoken.payload, callback);
       }
@@ -95,0 +100,0 @@ ], function(err, results){

package.json

 {
   "name": "express-jwt",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "JWT authentication middleware.",
@@ -5,0 +5,0 @@ "keywords": [

test/jwt.test.js

@@ -246,2 +246,18 @@ var jwt = require('jsonwebtoken');
   });
+  
+  it('should work with a secretCallback function that accepts header argument', function() {
+    var secret = 'shhhhhh';
+    var secretCallback = function(req, headers, payload, cb) {
+      assert.equal(headers.alg, 'HS256');
+      assert.equal(payload.foo, 'bar');
+      process.nextTick(function(){ return cb(null, secret) });
+    }
+    var token = jwt.sign({foo: 'bar'}, secret);
+
+    req.headers = {};
+    req.headers.authorization = 'Bearer ' + token;
+    expressjwt({secret: secretCallback})(req, res, function() {
+      assert.equal('bar', req.user.foo);
+    });
+  });
 });

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

25134

increased by3.3%

Lines of code

456

increased by4.35%

Worsened metrics

Number of medium supply chain risk alerts

1

increased byInfinity%

No dependency changes