How to get token from unprotected route about jwt HOT 3 CLOSED

You can initialize koajwt with the option passthrough:true to ensure that downstream middleware is called even when the auth fails. Then you can create a further middleware that returns a 401 if ctx.state.user is empty and use that for the authenticated routes.

from jwt.

Actually now that I think about it, this won't work. Why do you want to do this? You could do this by using the jsonwebtoken library's jwt.decode function directly for the unprotected routes. See https://www.npmjs.com/package/jsonwebtoken#jwtdecodetoken--options

from jwt.

Why do you want to do this?

I have an entity that can be publicly visible but depending on the record property (entity.public: true/false) it determines whether the person requesting the data has access to it.

So for example, let's say I'm rebuilding github and I want to fetch a specific repository. I want that endpoint to be public because the system allows for public repos that don't require authorization. But if the resource the user is trying to fetch is private then I need to reject the request. Does that make sense?

Yeah that was my thinking as well: rebuild the parts of koa-jwt that extract the authorization header and manually add a ctx.state.user object for those unprotected routes.

from jwt.