upgrade passport-jwt and use auth header extractor

3 files changed, 44 insertions, 2 deletions

diff --git a/package.json b/package.json
index 47754adf..41bcabe0 100644
--- a/package.json
+++ b/package.json
@@ -52,7 +52,7 @@
     "mysql2": "^1.5.1",
     "node-http-proxy": "^0.2.3",
     "passport": "0.3.2",
-    "passport-jwt": "^2.2.1",
+    "passport-jwt": "^4.0.0",
     "passport-jwt.socketio": "https://github.com/erreina/passport-jwt.socketio",
     "passport-local": "1.0.0",
     "redis": "2.6.2",
diff --git a/passport.js b/passport.js
index 29d1862f..730601d7 100644
--- a/passport.js
+++ b/passport.js
@@ -13,7 +13,7 @@ function cookieExtractor (req) {
 module.exports = (db) => {
   passport.use(
     new jwt.Strategy({
-      jwtFromRequest: jwt.ExtractJwt.fromExtractors([cookieExtractor]),
+      jwtFromRequest: jwt.ExtractJwt.fromExtractors([jwt.ExtractJwt.fromAuthHeaderAsBearerToken(), cookieExtractor]),
       secretOrKey: process.env.SECRET
     }, async (payload, next) => {
       try {
diff --git a/yarn.lock b/yarn.lock
index 6c76a553..55d721fa 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2432,6 +2432,12 @@ ecc-jsbn@~0.1.1:
   dependencies:
     jsbn "~0.1.0"
 
[email protected]:
+  version "1.0.10"
+  resolved "https://registry.yarnpkg.com/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.10.tgz#1c595000f04a8897dfb85000892a0f4c33af86c3"
+  dependencies:
+    safe-buffer "^5.0.1"
+
 [email protected]:
   version "1.0.9"
   resolved "https://registry.yarnpkg.com/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.9.tgz#4bc926274ec3b5abb5016e7e1d60921ac262b2a1"
@@ -4331,6 +4337,20 @@ jsonwebtoken@^8.1.1:
     ms "^2.1.1"
     xtend "^4.0.1"
 
+jsonwebtoken@^8.2.0:
+  version "8.4.0"
+  resolved "https://registry.yarnpkg.com/jsonwebtoken/-/jsonwebtoken-8.4.0.tgz#8757f7b4cb7440d86d5e2f3becefa70536c8e46a"
+  dependencies:
+    jws "^3.1.5"
+    lodash.includes "^4.3.0"
+    lodash.isboolean "^3.0.3"
+    lodash.isinteger "^4.0.4"
+    lodash.isnumber "^3.0.3"
+    lodash.isplainobject "^4.0.6"
+    lodash.isstring "^4.0.1"
+    lodash.once "^4.0.0"
+    ms "^2.1.1"
+
 jsprim@^1.2.2:
   version "1.4.0"
   resolved "https://registry.yarnpkg.com/jsprim/-/jsprim-1.4.0.tgz#a3b87e40298d8c380552d8cc7628a0bb95a22918"
@@ -4349,6 +4369,14 @@ jwa@^1.1.4:
     ecdsa-sig-formatter "1.0.9"
     safe-buffer "^5.0.1"
 
+jwa@^1.1.5:
+  version "1.1.6"
+  resolved "https://registry.yarnpkg.com/jwa/-/jwa-1.1.6.tgz#87240e76c9808dbde18783cf2264ef4929ee50e6"
+  dependencies:
+    buffer-equal-constant-time "1.0.1"
+    ecdsa-sig-formatter "1.0.10"
+    safe-buffer "^5.0.1"
+
 jws@^3.0.0, jws@^3.1.4:
   version "3.1.4"
   resolved "https://registry.yarnpkg.com/jws/-/jws-3.1.4.tgz#f9e8b9338e8a847277d6444b1464f61880e050a2"
@@ -4357,6 +4385,13 @@ jws@^3.0.0, jws@^3.1.4:
     jwa "^1.1.4"
     safe-buffer "^5.0.1"
 
+jws@^3.1.5:
+  version "3.1.5"
+  resolved "https://registry.yarnpkg.com/jws/-/jws-3.1.5.tgz#80d12d05b293d1e841e7cb8b4e69e561adcf834f"
+  dependencies:
+    jwa "^1.1.5"
+    safe-buffer "^5.0.1"
+
 jwt-simple@^0.5:
   version "0.5.1"
   resolved "https://registry.yarnpkg.com/jwt-simple/-/jwt-simple-0.5.1.tgz#79ea01891b61de6b68e13e67c0b4b5bda937b294"
@@ -5485,6 +5520,13 @@ passport-jwt@^2.2.1:
     jsonwebtoken "^7.0.0"
     passport-strategy "^1.0.0"
 
+passport-jwt@^4.0.0:
+  version "4.0.0"
+  resolved "http://registry.npmjs.org/passport-jwt/-/passport-jwt-4.0.0.tgz#7f0be7ba942e28b9f5d22c2ebbb8ce96ef7cf065"
+  dependencies:
+    jsonwebtoken "^8.2.0"
+    passport-strategy "^1.0.0"
+
 [email protected]:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/passport-local/-/passport-local-1.0.0.tgz#1fe63268c92e75606626437e3b906662c15ba6ee"