Added more validation to validateToken

Author: Luciano Nooijen

controllers/auth.js

@@ -47,12 +47,23 @@ const generateToken = async (username, password) => {
 };
 
 const validateToken = async token => {
-    const decodedToken = decodeJWT(token);
+    let decodedToken = '';
+
+    // Check if token can be decoded, is valid format
+    try {
+        decodedToken = decodeJWT(token);
+    } catch (err) {
+        return false;
+    }
+
+    // Check if token has not expired
     try {
         validateJWT(token);
     } catch (err) {
         return false;
     }
+
+    // Check if user from payload exists
     const tokenUserID = decodedToken.data.id;
     const tokenUser = await Users.getUser(tokenUserID);
     if (!tokenUser) {

tests/controllers/auth.test.ts

@@ -86,6 +86,13 @@ describe('Auth Controller', () => {
         expect(invalidTokenIsValid).toBe(false);
     });
 
+    test('validateToken should fail if token is invalid format', async () => {
+        expect.assertions(1);
+        const invalidToken = 'thisisaninvalidtoken';
+        const invalidTokenIsValid = await validateToken(invalidToken);
+        expect(invalidTokenIsValid).toBe(false);
+    });
+
     test('validateToken should fail if token has expired', async () => {
         expect.assertions(1);
         const addedUser = await addUser(testUser2);