Write a JWT authentication middleware

What's really being asked

This evaluates secure authentication design: correct token extraction, signature verification, attaching identity, and the discipline of returning after a 401 so the chain stops.

The full answer

Read the Authorization header, which conventionally looks like 'Bearer <token>'. Guard against a missing header, then split off the scheme to get the raw token. Verify it with jwt.verify(token, secret) inside a try/catch, since verify throws on an invalid or expired signature. On success, attach the decoded payload to req.user so downstream handlers know who is calling, then call next(). On any failure, send res.status(401).json({...}) and return immediately so you do not also call next(), which would otherwise continue the chain and risk a double response. Critically, you must verify the signature, not merely decode it; jwt.decode does not check authenticity.

The mistakes people make

Using jwt.decode (no signature check) instead of jwt.verify, accepting forged tokens. Calling next() after sending the 401, causing 'Cannot set headers after they are sent'. Not handling a missing or malformed header. Hardcoding the secret in source instead of an env var.

What usually comes next

Where do you store the secret? How do you handle token expiry versus tampering? How would you add role-based authorization on top? Why prefer the auth0/express-jwt library?

A concrete example

function auth(req, res, next) { const header = req.headers.authorization; if (!header) return res.status(401).json({ error: 'missing token' }); const token = header.split(' ')[1]; try { req.user = jwt.verify(token, process.env.JWT_SECRET); next(); } catch { res.status(401).json({ error: 'invalid token' }); } } Valid tokens attach req.user and proceed; invalid ones get a single 401 and the chain stops cleanly.