JWTs

A JWT is a JSON Web Token. It's a cryptographically signed JSON object that contains information about the user. You'll learn about how the cryptography of JWTs work in our Learn Cryptography course. For now, it's just important to know that once the token is created by the server, the data in the token can't be changed without the server knowing.

When your server issues a JWT to Bob, Bob can use that token to make requests as Bob to your API. Bob won't be able to change the token to make requests as Alice.

The first building blocks you'll write are the functions for creating and validating JWTs, which will be used in the next lesson to authenticate users. We'll also create some unit tests to ensure that the functions work as expected.

1. Install jsonwebtoken:

npm i jsonwebtoken
npm i -D @types/jsonwebtoken

2. Import jsonwebtoken and create a makeJWT function in your auth.ts file.

import jwt from "jsonwebtoken";

function makeJWT(userID: string, expiresIn: number, secret: string): string;

Use jwt.sign(payload, secret, [options]).

A JWT payload can have any key-value pair, but I used the Pick utility function to narrow the JwtPayload type down to the keys we care about:

import type { JwtPayload } from "jsonwebtoken";

type payload = Pick<JwtPayload, "iss" | "sub" | "iat" | "exp">;

• iss is the issuer of the token. Set this to chirpy
• sub is the subject of the token, which is the user's ID.
• iat is the time the token was issued. Use Math.floor(Date.now() / 1000) to get the current time in seconds.
• exp is the time the token expires. Use iat + expiresIn to set the expiration

3. Add a validateJWT function to your auth.ts file:

function validateJWT(tokenString: string, secret: string): string;

Use the jwt.verify(token, secret) function to validate the signature of the JWT and extract the decoded token payload. It will throw an error if the token is invalid or has expired. If the token is invalid, throw a suitable error. Return the user's id from the token (which should be stored in the sub field).

4. Let's make sure our JWT creation and validation works as expected. Install Vitest:

npm i -D vitest@3

5. Add the "test": "vitest --run" to package.json in the "scripts" object, it should look something like this:

  "scripts": {
    "test": "vitest --run"
  },

6. Create an auth.test.ts file. Vitest will automatically run any files with the .test.ts extension.
7. Import describe, it, expect and beforeAll from vitest, and your functions from auth.ts:

import { describe, it, expect, beforeAll } from "vitest";
import { makeJWT, validateJWT } from "./auth";

8. Write some tests. Make sure that you can create and validate JWTs, that expired tokens are rejected, and JWTs signed with the wrong secret are rejected. Here's how you could write a test for the password hashing we did previously.

describe("Password Hashing", () => {
  const password1 = "correctPassword123!";
  const password2 = "anotherPassword456!";
  let hash1: string;
  let hash2: string;

  beforeAll(async () => {
    hash1 = await hashPassword(password1);
    hash2 = await hashPassword(password2);
  });

  it("should return true for the correct password", async () => {
    const result = await checkPasswordHash(password1, hash1);
    expect(result).toBe(true);
  });
});

Just add more it blocks within describe blocks to create more tests.

Run and submit the CLI tests.