Ufdjrw

I have a express nodejs backend which has three URL functions in which

1) registerUser() added user details to database and provided a JWT for the caller

2) verifyToken()- verifies if the JWT is valid

3) getConfiguration()- if JWT is verified from above function provides user with some configuration data

So the express code I'm using to achieve this is

//Routes.js

app.use(requestIp.mw())

app.route('/register')
 .post(userController.registerUser);

app.use(userController.verifyToken)

app.route('/user/configuration')
 .post(chayakkadaController.getConfiguration);

Now my issue is whenever I try calling the URL /register instead of calling registerUser function it calls verifyToken and says my token is invalid ( I want registerUser function to work without token, but getConfiguration should work only with token)

This is my verifyToken function

export function verifyToken(req, res, next) req.headers["token"];
var appData = ;
if (token) 
 jwt.verify(token, process.env.SECRET_KEY, function (err, decoded) 
 if (err) 
 appData["status"] = 1;
 appData["error"] = "Invalid Token";
 res.status(500).json(appData);
 else 
 req.user = decoded;
 next();
 
 );
 else 
 appData["status"] = 1;
 appData["error"] = "Need access token";
 res.status(403).json(appData);

My register User code

export function registerUser(req, res) 
let userData = 
 device: req.body.device,
 device_version: req.body.device_version,
 device_id: req.body.device_id,
 app_version: req.body.app_version,
 app_id: 2,
 ip_address: req.headers['x-real-ip'] 
database.query(`INSERT INTO users SET ?`, userData)
 .then(result => 
 let user = 
 id: result.insertId
 
 let token = jwt.sign(user, process.env.SECRET_KEY);
 let appData = ;
 appData["token"] = token;
 redis.sendMessage(
 qname: 'registration_queue',
 message: result.insertId + '',
 , (err, resp) => 
 res.status(201).json(appData);
 );

 )
 .catch(err => 
 console.log(err);
 res.status(500).json("Database Error");
 )

Why you wanna to invent the wheel? there is a NPM module for that:
express-jwt

It has middleware that checks the jwt, if it valid, it decodes the payload and adds it to the request after that it proceed to your controller, if it is not valid, it throws an error, that you should catch, and do what ever you want.

It has the unless feature, so you can configure the entire subpath as restricted unless it is /register

router.use(`admin/`, [
 expressJwt( secret: jwtSecret ).unless(
 path: ['/register]
 ),
]);