JsonWebTokenError: jwt must be provided nest JS - node.js

Question

I'm trying to pass some data from my local backend using nest.JS, the login is successful and the jwt token is shown in the cookies, but the error says:
[Nest] 39 - 02/22/2022, 9:50:59 AM ERROR [ExceptionsHandler] jwt must be provided
nest-admin-backend-1 | JsonWebTokenError: jwt must be provided
nest-admin-backend-1 | at Object.module.exports [as verify] (/app/node_modules/jsonwebtoken/verify.js:53:17)
nest-admin-backend-1 | at /app/node_modules/#nestjs/jwt/dist/jwt.service.js:42:53
nest-admin-backend-1 | at new Promise (<anonymous>)
nest-admin-backend-1 | at JwtService.verifyAsync (/app/node_modules/#nestjs/jwt/dist/jwt.service.js:42:16)
nest-admin-backend-1 | at AuthService.userId (/app/src/auth/auth.service.ts:16:44)
nest-admin-backend-1 | at AuthController.user (/app/src/auth/auth.controller.ts:68:43)
nest-admin-backend-1 | at /app/node_modules/#nestjs/core/router/router-execution-context.js:38:29
nest-admin-backend-1 | at processTicksAndRejections (node:internal/process/task_queues:93:5
as for the code, there is no error anywhere, I'm following the tutorial as it should and it doesn't work.
If I'm following the error message, it says the error on my auth.service & auth.controller file, so here is my file snippets:
Auth.controller
export class AuthController {
constructor(
private userService: UserService,
private jwtService: JwtService,
private authService: AuthService,
) {
}
#Post('register')
async register(#Body() body: RegisterDto) {
if (body.password !== body.password_confirm) {
throw new BadRequestException('Password do not match!');
}
const hashed = await bcrypt.hash(body.password, 12);
{ }
return this.userService.create({
firstName: body.firstName,
lastName: body.lastName,
email: body.email,
password: hashed,
role: { id: 1 }
});
}
#Post('login')
async login(
#Body('email') email: string,
#Body('password') password: string,
#Res({ passthrough: true }) response: Response,
) {
const user = await this.userService.findOne({ email });
if (!user) {
throw new NotFoundException('User not found!');
}
if (!await bcrypt.compare(password, (await user).password)) {
throw new BadRequestException('Invalid password!');
}
// Generate JWT
const jwt = await this.jwtService.signAsync({ id: user.id })
response.cookie('jwt', jwt, { httpOnly: true });
return user;
}
#UseGuards(AuthGuard) // This is a custom guard
// Authenticate user and generate JWT
#Get('user')
async user(#Req() request: Request) {
const id = await this.authService.userId(request);
// Get user from the database
return this.userService.findOne({ id });
}
#UseGuards(AuthGuard) // Check if user is authenticated
#Post('logout')
async logout(#Res({ passthrough: true }) response: Response) {
response.clearCookie('jwt');
return {
message: 'Logged out successfully',
}
}
}
Auth.service
export class AuthService {
constructor(private jwtService: JwtService) {
}
async userId(request: Request): Promise<number> {
const cookie = request['jwt'];
// Get data from the Cookie
const data = await this.jwtService.verifyAsync(cookie);
// Get user from the database
return data['id'];
}
}
I can't access the localhost:8000/api/user from the postman too, even if I'm already logged in. Any idea how to solve it?

Answer 1

Cookies are a protocol between HTTP servers and browsers so Postman and Backends can't just log in and have the cookie header sent.
To allow Applications (mobile, desktop, and server) to be identified by your API server will need to introduce an additional way to send the JWT.
Allow JWT to be sent as an HTTP header in addition to Cookies. Use the Authorization header as a secondary method to send the JWT in.
To achieve this you will need to:
modify your /login to return the JWT as plain text (instead of User)
#Post('login')
async login(
#Body('email') email: string,
#Body('password') password: string,
#Res({ passthrough: true }) response: Response,
) {
const user = await this.userService.findOne({ email });
...
// Generate JWT
const jwt = await this.jwtService.signAsync({ id: user.id })
response.cookie('jwt', jwt, { httpOnly: true }); // <-- for browsers
return jwt; // <--- for applications
}
Now it's the application's responsibility to store and send JWT (using the Authorization header) on subsequences request
Update your AuthGuard to check for JWT in the cookie and Authorization header.