Prevent crash on invalid JWT

u-wave · Dec 1, 2023 · 8029e95 · 8029e95
1 parent c9ed5f1
commit 8029e95
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/src/plugins/passport.js b/src/plugins/passport.js
@@ -77,7 +77,14 @@ class PassportPlugin extends Passport {
       passwordField: 'password',
       session: false,
     }, callbackify(localLogin)));
-    this.use('jwt', new JWTStrategy(options.secret, (user) => uw.users.getUser(user.id)));
+    this.use('jwt', new JWTStrategy(options.secret, async (user) => {
+      try {
+        return await uw.users.getUser(user.id);
+      } catch (err) {
+        this.#logger.warn({ err, user }, 'could not load user from JWT');
+        return null;
+      }
+    }));
 
     uw.config.register(schema['uw:key'], schema);
     const unsubscribe = uw.config.subscribe(schema['uw:key'], /** @param {SocialAuthSettings} settings */ (settings) => {