jsonwebtoken v9 verify function doesn't work in typescript

[akkadaya]

After upgrading jsonwebtoken to v9, React-Native app written in Typescript can't verify the JWT and throws an error

[TypeError: right operand of 'instanceof' is not an object]

import jwt from 'jsonwebtoken'
...
try {
    return !!jwt.verify(token, publicKey)
} catch (error) {
    console.log(error)
    return false
}

But in a JavaScript file run by node it works fine!

[Uzlopak]

KeyObject is probably missing in browserify crypto

[panva]

jsonwebtoken is a Node.js module, always was, its use in a browser or React-Native environments was never intended. Versions before 9.0.0 could use webpack's polyfill of the Node.js built-in modules. This most likely a) relied on slow js cryptography that isn't maintained anymore and lacks feature parity with Node's crypto and b) increased your js bundle size considerably. FWIW webpack 5 also no longer defaults to using these questionable crypto polyfills anymore.

It is better to rely on JWT modules made to be consumed in browser or generic javascript environments. You can discover such modules on jwt.io under "JavaScript" libraries.

[ZumelzuR]

jsonwebtoken is a Node.js module, always was, its use in a browser or React-Native environments was never intended. Versions before 9.0.0 could use webpack's polyfill of the Node.js built-in modules. This most likely a) relied on slow js cryptography that isn't maintained anymore and lacks feature parity with Node's crypto and b) increased your js bundle size considerably. FWIW webpack 5 also no longer defaults to using these questionable crypto polyfills anymore.

It is better to rely on JWT modules made to be consumed in browser or generic javascript environments. You can discover such modules on jwt.io under "JavaScript" libraries.

This erro also appear on Nodejs using express, that is a backend framework so this issue is not about React

[panva]

This erro also appear on Nodejs using express, that is a backend framework so this issue is not about React

That's very strange indeed, would you please disclose the following output? I just want to make sure you're running the expected Node.js process version.

console.log({ version: process.version, release: process.release });

[ZumelzuR]

This erro also appear on Nodejs using express, that is a backend framework so this issue is not about React

That's very strange indeed, would you please disclose the following output? I just want to make sure you're running the expected Node.js process version.

console.log({ version: process.version, release: process.release });

At the end I fix the issue. Was that I was using Node version 10. After update Node to v14 all worked good. Thanks

[tiffanyiong]

I also had this error when I used node v 12.16.1 and jwt 9.0.0
installing node@12.19 or above will solve the problem.

I believe the error we saw refers to the KeyObject that is coming from this line of code in verify.js file (from jsonwebtoken@9.0.0):
if (secretOrPublicKey != null && !(secretOrPublicKey instanceof KeyObject))

there's a big change in the KeyObject class from node@12.19 in this PR : nodejs/node#33360
(jsonwebtoken uses crypto module from node, and KeyObject is in that module)

Originally (before this PR), this KeyObject was not exposed to users. instead, users could use other functions to construct the key objects
so node@12.16.1 that I used didn't include the changes (expose to users) in the PR, so the KeyObject won't work for jsonwebtoken@9.0.0, which means verify() won't work

for jsonwebtoken v.8.5.1, its verify() function doesn't use KeyObject, so it should work with the node version that's below node@12.19

[dhwang]

Node 15 implementation adds WebCrypto and CryptoKey
and has implementation for both isCryptoKey and isKeyObject
Latest has addition of utility method for the same So...

What blocks jsonwebtoken from creating similar isCryptoKey and isKeyObject and test both?

This library has been is much smaller package for its purpose and we like to keep using it instead of the alternatives.