jwt authorization token missing from response header

Question

I'm trying to setup a simple Angularjs app with Hapi, using JWT authentication.

I send an email to newly registered user with a jwt token link to verify if the email exists. The link looks like this:

http://127.0.0.1:3000/verifyEmail/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyTmFtZSI6InJpY2tAaWNvZGU0dS5ubCIsInNjb3BlIjpbIkN1c3RvbWVyIl0sImZpcnN0TmFtZSI6IlJpY2siLCJsYXN0TmFtZSI6IkdvbW1lcnMiLCJpYXQiOjE0NDkxNDc5MzR9.6lWxcsSIC7DgAiGC0hcp7bdAhyl40Nbcqid3VgVtM6c

This is how I generate the token:

handler: function(request, reply) {
    request.payload.password = Common.encrypt(request.payload.password);
    request.payload.scope = "Customer";
    User.saveUser(request.payload, function(err, user) {
        if (!err) {
            var tokenData = {
                userName: user.userName, //email address
                scope: [user.scope],
                firstName: user.firstName,
                lastName: user.lastName
            };
            Common.sentMailVerificationLink(user,Jwt.sign(tokenData, privateKey));
            reply("Please confirm your email id by clicking on link in email");
        } else {
            if (11000 === err.code || 11001 === err.code) {
                reply(Boom.forbidden("please provide another user email"));
            } else {
                console.log(Boom.forbidden(err));
                reply(Boom.forbidden(err)); // HTTP 403
            }
        }
    });
}

Now when I click the verification link, the response header looks like this:

{ host: '127.0.0.1:3000',
  connection: 'keep-alive',
  accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;
q=0.8',
  'upgrade-insecure-requests': '1',
  'user-agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KH
TML, like Gecko) Chrome/46.0.2490.86 Safari/537.36',
  dnt: '1',
  'accept-encoding': 'gzip, deflate, sdch',
  'accept-language': 'nl-NL,nl;q=0.8,en-US;q=0.6,en;q=0.4,fr;q=0.2,es;q=0.2',
  'x-cookiesok': 'I explicitly accept all cookies' }

The Question: I am missing the Authorization token from the response header. How can I send the Authorization token in the header?

The token is in the link and a link cannot set headers. I think you just have to get your token back from url. — Sachacr
Thx sachacr, I got it working by splitting the token from the url :) — Forza

Sachacr Sachacr · Accepted Answer · 2015-12-04T15:22:43

You send the token in the url so it can't return in the headers. You have to get it back from the url.

jwt authorization token missing from response header

1 Answers