How to check JsonWebToken (JWT) in Headers? - node.js

Question

I have a middleware to protect a route. And I am checking whether the token is present in headers or not??
if(req.headers.authorization && req.headers.authorization.startsWith('Bearer')){
token = req.headers.authorization.split(" ")[1]
}
*My Question is is it necessary to add something like already did in above code by adding Bearer? is it something that enhance token presence checking or it is just a way.
i think this way should also work
if(req.headers.authorization){
token = req.headers.authorization
}
What will be the difference between these two?

Answer 1

What will be the difference between these two?
if(req.headers.authorization && req.headers.authorization.startsWith('Bearer')){
token = req.headers.authorization.split(" ")[1]
}
It will check if the authorization header exits and assign the authorization string including bearer with it and you need to segregate it first to verify the token
if(req.headers.authorization){
token = req.headers.authorization
}
It will check the authorization exists or not and if it does, it includes the Bearer. It is fine to check, however, not needed unless you follow same approach for all the APIs
You should do this:
const jwt = require('jsonwebtoken');
const verifyToken = async (req, res, next) => {
const { authorization } = req.headers;
const token = authorization.split(' ')[1];
try {
const jt = await jwt.verify(token, 'key');
//do something
} catch (error) {
res.status(401).send("Unauthorized");
}
}
module.exports = verifyToken;

Answer 2

1. The difference between the 2 code.
The 2 codes have the same objective: get the JWT in the header Authorization. They will behave differently based on the way you send the JWT in the request.
2. Explain
Usually, we send the JWT token to the server by using Bearer Authentication. In this mode :
The client must send this token in the Authorization header when
making requests to protected resources:
Authorization: Bearer [[token]]
(Source : https://swagger.io/docs/specification/authentication/bearer-authentication/)
So, to retrieve the token from the request, we must :
Firstly, ensure that the request has the Authorization header in the right format
Secondly, split the authorization header by space, and the token is the second element of the array.
That is what the first version does.
(Note: It should check whether the header contains a space or not before splitting the string
if(req.headers.authorization && req.headers.authorization.startsWith('Bearer ')){
token = req.headers.authorization.split(" ")[1]
}
)
3. Conclusion
The first version is based on a popular standard and should be use with a small modification :)