Core: authentication with jwt does not work anymore

[rhwilr]

After updating from 4.0.28 to 4.0.29 a correctly authenticated request with Bearer token returns null when accessing auth.user

[thetutlage]

Would you mind re-generate the JWT token and then verify?

[rhwilr]

Ia am using fresh tokens. I use the following code to generate a token for a user:

const token = await auth
        .withRefreshToken()
        .attempt(email.trim(), password)

and use the returned token on subsequent requests. Until now this method returned the current user based on the token:

async get ({auth}) {
    return auth.user
}

[thetutlage]

Looking into it

[thetutlage]

Seems to be working fine on my end. Can u share the JWT config from config/auth.js file?

[rhwilr]

Sure.

{
  authenticator: 'jwt',
  jwt: {
    serializer: 'lucid',
    model: 'App/Models/User',
    scheme: 'jwt',
    uid: 'email',
    password: 'password',
    options: {
      secret: 'self::app.appKey'
    }
  }
}

[rhwilr]

I'm looking through the changes since 4.0.28 and can't find anything related to api or authentication..
But it is definitely related to "@adonisjs/framework": "^4.0.29" because if I go back a version it works again.

[thetutlage]

Everything seems to be fine. So there was security bug in the way config values are resolved. I fixed that, but everything seems to be working fine after that at my end.

Lemme do a full diagnose and get back to you

[thetutlage]

@rhwilr Do u want to try it once by installing following repos from Github ( develop branch )

npm install https://github.com/adonisjs/adonis-framework.git\#develop
npm install https://github.com/adonisjs/adonis-auth.git\#develop

[rhwilr]

Your awesome! It works :+1:
I guess I will have to change

   jwt: {
     secret: 'self::app.appKey'
   }

as mentioned in your blog post. Would you recommend changing it to:

   jwt: {
     secret: Env.get('APP_KEY')
   }

[thetutlage]

Yes. I am planning to drop self reference since it causes performance overhead.

[thetutlage]

Published at @adonisjs/[email protected] and @adonisjs/[email protected]

[rhwilr]

You're the best! Thanks for resolving this issue so quickly. :+1:

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.