Unable to access protected routes using JWT in NodejJS - node.js

Question

I am trying to protect application routes using jwt.I am able to generate jwt and to validate jwt I have created middleware authorize.js which I am passing to /sec route in below code but when I am trying to access protected routes using jwt it showing below error:
Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client
at ServerResponse.setHeader (_http_outgoing.js:518:11)
at ServerResponse.header (D:\Backend\NodeJs\aws_test\node_modules\express\lib\response.js:771:10)
at ServerResponse.send (D:\Backend\NodeJs\aws_test\node_modules\express\lib\response.js:170:12)
at ServerResponse.json (D:\Backend\NodeJs\aws_test\node_modules\express\lib\response.js:267:15)
at D:\Backend\NodeJs\aws_test\server.js:24:9
at Layer.handle [as handle_request] (D:\Backend\NodeJs\aws_test\node_modules\express\lib\router\layer.js:95:5)
at next (D:\Backend\NodeJs\aws_test\node_modules\express\lib\router\route.js:137:13)
at D:\Backend\NodeJs\aws_test\auth.js:21:20
at Object.module.exports [as verify] (D:\Backend\NodeJs\aws_test\node_modules\jsonwebtoken\verify.js:53:12)
at authorize (D:\Backend\NodeJs\aws_test\auth.js:11:13)
Below is how I am setting jwt in POSTMAN:
Below is my code:
server.js
const express = require('express');
const jwt = require('jsonwebtoken');
const authorize = require('./auth');
const chalk = require('chalk');
const app = express();
const port = 3000 || process.env.PORT;
app.get('/',(req,res) => {
res.send("Home page");
});
app.get('/jwt',(req,res) => {
let token = jwt.sign({"body":"stuff"},"mypassphrase",{ algorithm: 'HS256'});
console.log(chalk.blue(token));
});
app.get('/sec',authorize,(req,res) => {
res.json({"name":"Hello digi"});
});
app.listen(port,(req,res) => {
console.log(chalk.green(`App is running at ${port}`));
});
auth.js
const fs = require('fs');
const jwt = require('jsonwebtoken');
authorize = (req,res,next) => {
if(typeof req.headers.authorization !== "undefined"){
let token = req.headers.authorization.split(" ")[1];
let key = fs.readFileSync('./private.pem','utf-8');
jwt.verify(token, key,{ algorithm: "HS256" },(err,user) => {
if (err) {
// shut them out!
res.json({ error: "Not Authorized" });
// throw new Error("Not Authorized");
}
// if the JWT is valid, allow them to hit
// the intended endpoint
return next();
});
}
else{
// No authorization header exists on the incoming
// request, return not authorized and throw a new error
res.json({ error: "No Authorization header" });
// throw new Error("Not Authorized");
}
}
module.exports = authorize;
What I am doing wrong in above code or what need to be correct.

Answer 1

The only execution path that looks to be liable to cause the error you're seeing is the following - in the autorize middleware:
if (err) {
res.json({ error: "Not Authorized" }); // you're not returning here
}
return next();
In case of an error happening here, you're not returning execution to the calling code when sending back a response to the client, so the current request is fowarded to the next middelware in line - which will end up resulting in another response being sent.
As for the reason why this path is being executed in the first place, judging from your Postman screen grab, the value you're setting for the Authorization header looks it may be incorrect - you're setting the value to jwt, and the description to the actual token, while you would actually want to set the value to the combination of both separated by a space like jwt token.