Express 5 + jsonwebtoken auth middleware: working versions (tested 2026-10-15)

{
  "name": "express-jwt-auth",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "express": "5.3.0",
    "jsonwebtoken": "9.0.3"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2",
    "supertest": "7.3.1",
    "@types/express": "5.0.6",
    "@types/supertest": "7.2.1",
    "@types/jsonwebtoken": "9.0.10"
  }
}

import express, { type Request, type Response, type NextFunction } from "express";
import jwt from "jsonwebtoken";

const SECRET = process.env.JWT_SECRET ?? "dev-only-secret-change-me";

export function requireAuth(req: Request, res: Response, next: NextFunction) {
  const header = req.headers.authorization ?? "";
  const token = header.startsWith("Bearer ") ? header.slice(7) : null;
  if (!token) return res.status(401).json({ error: "missing token" });
  try {
    res.locals.user = jwt.verify(token, SECRET, { algorithms: ["HS256"] });
    next();
  } catch {
    res.status(401).json({ error: "invalid token" });
  }
}

export function createApp() {
  const app = express();
  app.use(express.json());
  app.post("/login", (req, res) => {
    if (req.body?.password !== "correct-horse") return res.status(401).json({ error: "bad credentials" });
    res.json({ token: jwt.sign({ sub: req.body.username }, SECRET, { algorithm: "HS256", expiresIn: "15m" }) });
  });
  app.get("/me", requireAuth, (_req, res) => res.json({ sub: res.locals.user.sub }));
  return app;
}

import { test } from "node:test";
import assert from "node:assert/strict";
import request from "supertest";
import jwt from "jsonwebtoken";
import { createApp } from "../src/app.ts";

test("login then access protected route", async () => {
  const app = createApp();
  const login = await request(app).post("/login").send({ username: "ada", password: "correct-horse" });
  assert.equal(login.status, 200);
  const me = await request(app).get("/me").set("authorization", `Bearer ${login.body.token}`);
  assert.deepEqual(me.body, { sub: "ada" });
});
test("rejects missing and forged tokens", async () => {
  const app = createApp();
  assert.equal((await request(app).get("/me")).status, 401);
  const forged = jwt.sign({ sub: "x" }, "other-secret");
  assert.equal((await request(app).get("/me").set("authorization", `Bearer ${forged}`)).status, 401);
});