express-jwt is middleware for Express that validates JSON Web Tokens and makes the decoded payload available on the request object.
The module solves the problem of authenticating requests in Express applications by validating JWTs before they reach route handlers. It wraps the jsonwebtoken library and integrates it as Express middleware. The decoded JWT payload is attached to the request object, defaulting to the `req.auth` property. By default, the middleware extracts tokens from the Authorization header as OAuth2 Bearer tokens, though this behavior can be customized through a `getToken` function. The middleware supports symmetric secrets, asymmetric public/private key pairs, and dynamic key retrieval through a callback function. Additional security features include token revocation checking via an `isRevoked` callback, custom expiration handling, and support for validating audience and issuer claims.
Developers should adopt this tool if they need straightforward JWT validation in Express applications. It suits projects that use Bearer token authentication and want to avoid writing custom validation logic. The middleware can be applied selectively to specific routes using Express router patterns or the `unless` method to exclude certain paths from protection. The `credentialsRequired` option allows requests without tokens to pass through to the next middleware, useful for endpoints that should work both with and without authentication. The module emphasizes security by requiring explicit specification of the `algorithms` parameter to prevent downgrade attacks and warns against mixing symmetric and asymmetric algorithms without additional validation.
The project maintains active engagement with security considerations, as evidenced by detailed warnings in the documentation about algorithm mixing and downgrade vulnerabilities. Development activity shows consistent attention to the middleware's integration with Express patterns and the underlying jsonwebtoken library. The codebase is written in TypeScript, providing type safety for developers using the module.
