JWT module

token.js

const jwt = require('jsonwebtoken')
const { readFileSync } = require('fs')

const private = readFileSync(__dirname + '/private.pem')
const public = readFileSync(__dirname + '/public.pem')

const {
  ISSUER = 'DevOops',
  SUBJECT = 'team@devoops.app',
  AUDIENCE = 'https://devoops.app'
} = process.env

const options = { 
  issuer: ISSUER, 
  subject: SUBJECT, 
  audience: AUDIENCE
}

module.exports = {
  sign: (payload, expiresIn = '12h') => {
    options.expiresIn = expiresIn
    options.algorithm = 'RS256'
    return jwt.sign(payload, privateKey, options)
  },

  verify: (token, aud) => {
    try {
      return jwt.verify(token, public, options, (err, decoded) => {
        if (err) return false
        const { audience } = decoded
        return audience === aud
      })
    } catch (error) {
      console.error(error)
      return false
    }
  }
}

• If the a JWT was issued for audience https://devoops.app, but the client app tries to use the JWT from https://example.com, then e.g. throw 403 Forbidden error as the audience identification fails to match. L31