title: Authenticating node API with passport-jwt
body: <p>I'm trying to setup JWT authentication using passport-jwt.  I think I've taken the right steps, but a test GET won't succeed and I don't know how to debug it.</p>
  
  <p>Here's what I've done:</p>
  
  <ol>
  <li><p>setup <a href="https://github.com/themikenicholson/passport-jwt">passport-jwt straight out of the doc</a> as much as possible</p>
  
  <pre><code>var jwtOptions = {
      secretOrKey: 'secret',
      issuer: "accounts.examplesoft.com",  // wasn't sure what this was, so i left as defaulted in the doc
      audience: "yoursite.net"   // wasn't sure what this was, so i left as defaulted in the doc
    };
  
  jwtOptions.jwtFromRequest = ExtractJwt.fromAuthHeader();
  
  passport.use(new JwtStrategy(jwtOptions, function(jwt_payload, done) {
    User.findOne({id: jwt_payload.sub}, function(err, user) {
      if (err) {
          return done(err, false);
      }
      if (user) {
          done(null, user);
      } else {
          done(null, false);
          // or you could create a new account
      }
    });
  }));
  </code></pre></li>
  <li><p>Added a token result to my user /login endpoint</p>
  
  <pre><code>var jwt = require('jsonwebtoken');
  // ...
  
  exports.postLogin = function(req, res, next) {
    passport.authenticate('local', function(err, user, info) {
      if (err) throw err;
      if (!user) {
          return res.send({ msg: 'Login incorrect' });
      }
      req.logIn(user, function(err) {
          if (err) throw err;
          var secretOrKey = jwtOptions.secretOrKey;
          var token = jwt.sign(user, secretOrKey, {
              expiresIn: 631139040 // 20 years in seconds
          });
          res.send({ user: user, jwtToken: "JWT " + token });
      });
    })(req, res, next);
  };
  </code></pre></li>
  </ol>
  
  <p>Things were looking good up to here.  I can login a user (using passport local auth) and the response was a I hoped...</p>
  
  <blockquote>
    <p>{
        "user": {
            "_id": "56c8b5bd80d16ef41ec705dd",
            "email": "peachy@keen.com",
            "password": "$2a$10$zd ... etc.",
            "__v": 0,
        },
        "jwtToken": "JWT eyJ0eXAiOiJ .... etc." }</p>
  </blockquote>
  
  <p>I created an unprotected test route like this...</p>
  
  <pre><code>// in my routes file
  app.get('/user/tokenTest', user.tokenTest);
  </code></pre>
  
  <p>And in my controller, a simple endpoint...</p>
  
  <pre><code>exports.tokenTest = function(req, res) {
      console.log(req.headers);
      res.send("token test!!");
  };
  </code></pre>
  
  <p>And GET-ing that works fine, too.</p>
  
  <ol start="3">
  <li><p>But then I try to protect that route like this:  </p>
  
  <pre><code>app.get('/user/tokenTest', passport.authenticate('jwt', { session: false }),
      user.tokenTest);
  </code></pre></li>
  </ol>
  
  <p>After I do that, nothing but sadness.  I send a request like this:</p>
  
  <pre><code>curl -k 'https://localhost:3443/user/tokenTest' -H 'Authorization: JWT eyJ0eXAiOiJ... etc.' 
  </code></pre>
  
  <p>And always, always get a 401:</p>
  
  <blockquote>
    <p>Unauthorized</p>
  </blockquote>
  
  <p>Console logs in the controller don't seem to execute, neither does logging in the <code>passport.use</code> strategy method.  I've tweaked and tweaked, but I'm a little lost.  The passport-jwt doc just supplies the example, and virtually no other help.</p>
  
  <p>Please, any ideas about either a mistake that I'm making above, or at least how to go about debugging??</p>