In multi-tenancy mode Authorization: Bearer undefined does not throw 401 Unauthorized error

[Arash Layeghi]

Description

Provide a clear and concise description of the issue, including what you expected to happen.

When we use multi-tenancy (using secretCallback) in the case that Authorization is: Bearer undefined the middleware surprisingly passes to next middlewares and doesn't throw 401 Unauthorized error. As I checked in this case secretCallback is not called at all.

Reproduction

Detail the steps taken to reproduce this error, what was expected, and whether this issue can be reproduced consistently or if it is intermittent.

Where applicable, please include:

• Code sample to reproduce the issue

const jwt = require("express-jwt");
const { getSecrets } = require("../secrets");

const gWorldAuth0Config = getSecrets("AUTH0_CONFIGS").gworld;
const gforceAuth0Config = getSecrets("AUTH0_CONFIGS").gforce;
const GWORLD_ISSUER_DEV = "https://login.globalworkandtravel.com";
const GWORLD_ISSUER_LIVE = "https://gwat.auth0.com";
const GFORCE_ISSUER_LIVE = "https://globalgforce.auth0.com";
let audience;

const secretCallback = (req, payload, done) => {
  const issuer = payload.iss;
  let secret;

  if (
    issuer.startsWith(GWORLD_ISSUER_DEV) ||
    issuer.startsWith(GWORLD_ISSUER_LIVE)
  ) {
    secret = Buffer.from(gWorldAuth0Config.clientSecret, "base64");
    audience = gWorldAuth0Config.clientID;
  } else if (issuer.startsWith(GFORCE_ISSUER_LIVE)) {
    secret = Buffer.from(gforceAuth0Config.clientSecret, "base64");
    audience = gforceAuth0Config.clientID;
  }

  if (!secret) {
    return done(new Error("Missing Secret"));
  }
  return done(null, secret);
};

module.exports = jwt({
  secret: secretCallback,
  audience,
  algorithms: ["HS256"],
});

• Log files (redact/remove sensitive information)
• Application settings (redact/remove sensitive information)
• Screenshots

Environment

Please provide the following:

• Version 6.0.0:
• Node.js v12.0.0:

[José F. Romaniello]

this should be covered by this test:

express-jwt/test/multitenancy.test.ts

Lines 41 to 53 in ef6d488

 it('should throw if an error ocurred when retrieving the token', function (done) { 
   const secret = 'shhhhhh'; 
   const token = jwt.sign({ iss: 'inexistent', foo: 'bar' }, secret); 
  
   req.headers = {}; 
   req.headers.authorization = 'Bearer ' + token; 
  
   middleware(req, res, function (err) { 
     assert.ok(err); 
     assert.equal(err.message, 'Could not find secret for issuer.'); 
     done(); 
   }); 
 });