title: JWT UnauthorizedError: No authorization token was found (GET request with cookie)
body: <p>I have a strange problem, or maybe I don't understand how JWT works in Express context.</p>
  
  <pre><code>var express = require('express')
  var app = express();
  var expressJWT = require('express-jwt');
  var jwt = require('jsonwebtoken');
  var cookieParser = require('cookie-parser');
  var bodyParser = require('body-parser');
  var unless = require('express-unless');
  
  
  app.set('secret', 'some secret');
  
  app.use(cookieParser());
  app.use(bodyParser.urlencoded({ extended: false }));
  app.use("/", expressJWT({secret:app.get('secret')})
    .unless({
      path:[
        '/',
        '/foo',
        '/login'
      ]}
    ));
  
  
    // my custom route middleware to verify a token
  app.use(function(req, res, next) {
    console.log("------------------------------------");
    console.log("route middleware to verify a token");
    console.log("");
    // check header or url parameters or post parameters for token
    var token = req.body.access_token || req.query.access_token || req.headers['x-access-token'] || req.cookies.access_token;
    console.log("req.cookies.access_token:", req.cookies.access_token);
    console.log("token:", token);
    // decode token
    if (token) {
  
      // verifies secret and checks exp
      jwt.verify(token, app.get('secret'), function(err, decoded) {
        if (err) {
          console.log("jwt.verify ERROR")
          return res.json({ success: false, message: 'Failed to authenticate token.', err:err });
        } else {
          console.log("jwt.verify OK")
          // if everything is good, save to request for use in other routes
          req.decoded = decoded;
          next();
        }
      });
  
    } else {
  
      // if there is no token
      // return an error
      return res.status(403).send({
          success: false,
          message: 'No token provided.'
      });
  
    }
  });
  
  
  app.get('/', function (req, res) {
  
    res.send('Hello World!. /foo is open, /bar is protected. Login at /login')
  })
  
  app.get('/foo', function (req, res) {
  
    res.send('Foo')
  })
  
  app.get('/bar', function (req, res) {
    res.send('Foo')
  })
  
  app.get('/login', function (req, res) {
    var username = 'mock_username';
    var myToken = jwt.sign({username:username}, app.get('secret'));
    res.cookie('access_token', myToken).send("logged in, check cookie");
  })
  
  
  app.listen(3000, function () {
    console.log('Example app listening on port 3000!')
  })
  </code></pre>
  
  <p>I'm setting up a JWT token and saving it to cookie in the /login route.
  This works and the token is set if I check cookie in the browser (dev tools in Chrome).</p>
  
  <ul>
  <li><p>I visit the / or <em>/foo</em> route (unprotected as specified with unless), and browser displays correct result, but the console still throws the <em>UnauthorizedError</em>. Why is the error showing in the console if I explicitly marked this as unprotected route with "unless"?</p></li>
  <li><p>I visit <em>/bar</em> route (protected), my middleware is not being called, I get the <em>UnauthorizedError</em> both in console and the browser. How do I make sure the middleware does get triggered here, and how do I provide the access to this route if the token is indeed found and verified in my middleware? </p></li>
  </ul>