Next.js Discord

Discord Forum

Next-auth token decryption in a separate server (web-sockets)

Unanswered
Maine Coon posted this in #help-forum
Open in Discord
Maine CoonOP
Hi, i'm using next-auth-v4 and i have a separate socket server (using socket-io) on which i want to add authentication, unfortunately the problem is that i'm not able to decrypt the token on a separate server using jsonwebtoken library and same secret. Then i looked upon the implementation of getToken from next-auth/jwt which in itself makes use of jose & @panva/hkdf library to encrypt & decrypt the token. I tried to isolate & create the decode function so that I could take the token from request and decrypt it and verify it in my socet server, but didn't work. Below is what i tried :-
import http from "http";
import express from "express";
import { Server } from "socket.io";
import jwt from "jsonwebtoken";

const app = express();
const server = http.createServer(app);
const io = new Server(server);
io.use(async (socket, next) => {
  const cookies = socket.handshake.headers.cookie.split(";");
  const token = cookies
    .find((cookie) => cookie.trim().startsWith("next-auth.session-token="))
    .split("=")[1];
  jwt.verify(
    token,
    process.env.NEXTAUTH_JWT_SECRET,
    { algorithms: ["HS512"] },
    (err, decoded) => {
      if (err) {
        console.log(err); // Error:  JsonWebTokenError: jwt malformed
        throw new Error("User is not authorized to access resources");
      }
      socket.request.user = decoded;
      next();
    }
  );
})

This doesn't seem to work, anyone help?

11 Replies

Chinese Egret
Hi, what is the error?
@Chinese Egret Hi, what is the error?
Maine CoonOP
Error: JsonWebTokenError: jwt malformed
i'm guessing next-auth token is encrypted using some different technique so this wouldn't work... i was hoping to get it working...
@Maine Coon `Error: JsonWebTokenError: jwt malformed`
Chinese Egret
What happens if you copy/paste the token here https://jwt.io/ ?
Maine CoonOP
let me check
@Chinese Egret What happens if you copy/paste the token here https://jwt.io/ ?
Maine CoonOP
Invalid signature
but i'm just using the cookie that next-auth uses next-auth.session-token value
Chinese Egret
Never used next-auth, are you sure that it is generating a valid jwt?
@Chinese Egret Never used next-auth, are you sure that it is generating a valid jwt?
Maine CoonOP
i'm too using it for the first time, yes this is what it saves it in cookie...
@Maine Coon i'm too using it for the first time, yes this is what it saves it in cookie...
Chinese Egret
Can you paste here an example of token?
@Chinese Egret Can you paste here an example of token?
Maine CoonOP
eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..iDif8FLKwk4o1rbd.fYDtUR-4p6kBNdstOzKFtZiVjh3GO77JaHINQXVfMOYQJ83VjgD-epJ2DQUaKz6sAaLb_At5j5Mv7NxeMJYJY3F8YfhcdRrfgsqqsRNKBPvAmWO3JflCG2hUMdIOSaoKLUnU504GGzRWlUk0x84Uk5hjdkQFe3yrKwe476jTzVXk8Cjj9QH3pASjtmBismPBd2ErxbIiBnC3YvvmWoSeNlYgPxXsXXD3KkJNxKzmyVzSCN3Fs0Tbp0EgxIWkgxLqpah7rKfLRCm7lVuE0yRrKrWPVHHAEgiXExlSNwInrC8cS2w8GH93Heg6B_EJqFcqSoGs9kD3LtDhyhEcC4LGQ8-kD8XwZISxzn7OMQ2CD03huo1BCXeHpGxmeQjihp9xkkIFHccrWhsZWKvLIT5qsZ17kl_u6BJGI92fjcOt7F1YcC2rTg.l6R3LUai2XL47FFg-RFe0w