Passport JWT is always returning 401 unauthorized when using OpenID Connect ID Token

Question

I am following this tutorial to enable jwt authentication in my express API. https://jonathanmh.com/express-passport-json-web-token-jwt-authentication-beginners/

If I use a standard username/password authentication, I am able to use JwtStrategy to authenticate the JWT Token that I receive in the request header. jwt.sign() happens on the user id and secret. All of this works fine.

When I try to modify this code to verify the id_token (JWT Token signed using RS256) from OpenID Connect, then I get 401 Unauthorized no matter what. I tried to debug in the JwtStrategy method and it looks like the request doesn't even go inside that function. This id_token appears to be a lot longer than the one signed with HS256 algorithm.

A simple passport.authenticate call app.get('/callback', passport.authenticate('jwt', { session: false }), function(req, res, next) { });

Can someone please explain why it doesn't even recognise my token?

Answer 1

It depends on how you are passing the token from client and reading it in server. The request will go into the validate function only if it receives the token correctly. Check similar post https://stackoverflow.com/a/46020083/4548946.

It worked for me. Hope it helps you too.