Failed refreshToken in jwt should be considered as the same as invalid JWT token #1380

New issue

Open

opened 2026-02-20 18:08:48 -05:00 by deekerman · 0 comments

deekerman commented

2026-02-20 18:08:48 -05:00

Owner

Originally created by @quangld on GitHub (Apr 16, 2020).

Originally assigned to: @NGPixel on GitHub.

if the refreshToken fails in this below code, it throws new WIKI.Error.AuthGenericError(). This will show the internal error on user's screen.

function authenticate in server\core\auth.js

// Expired but still valid within N days, just renew
...
    try {
        const newToken = await WIKI.models.users.refreshToken(jwtPayload.id)
...
    } catch (errc) {
        WIKI.logger.warn(errc)
        **return next()**
    }
}
// JWT is NOT valid, set as guest
if (!user) {
...
}

My suggestion is to set user to null, skip next(). That means the token is considered invalid.

// Expired but still valid within N days, just renew
...
    try {
        const newToken = await WIKI.models.users.refreshToken(jwtPayload.id)
...
    } catch (errc) {
        WIKI.logger.warn(errc)
        // return next()
        user = null // JWT token is invalid, continue with no user is set
    }
}
// JWT is NOT valid, set as guest
if (!user) {
...
}

Edited: fix formatting

Originally created by @quangld on GitHub (Apr 16, 2020). Originally assigned to: @NGPixel on GitHub. if the refreshToken fails in this below code, it throws new WIKI.Error.AuthGenericError(). This will show the internal error on user's screen. function **authenticate** in server\core\auth.js // Expired but still valid within N days, just renew ... try { const newToken = await WIKI.models.users.refreshToken(jwtPayload.id) ... } catch (errc) { WIKI.logger.warn(errc) **return next()** } } // JWT is NOT valid, set as guest if (!user) { ... } My suggestion is to set user to null, skip next(). That means the token is considered invalid. // Expired but still valid within N days, just renew ... try { const newToken = await WIKI.models.users.refreshToken(jwtPayload.id) ... } catch (errc) { WIKI.logger.warn(errc) // return next() user = null // JWT token is invalid, continue with no user is set } } // JWT is NOT valid, set as guest if (!user) { ... } Edited: fix formatting