express-jwt

library8.5.1jsnpmunverified

Express middleware for validating JWTs (JSON Web Tokens) via the jsonwebtoken library. As of v8.5.1, it supports async secret retrieval, token revocation checks, and a customizable request property (default `req.auth`). It is fully typed (TypeScript) and ESM/CJS compatible. Key differentiators: built-in `.unless()` for path exclusion, optional `credentialsRequired` for public endpoints, and all jsonwebtoken verify options (audience, issuer, clockTolerance, etc.). However, v7→v8 introduced several breaking changes: the exported function is now `expressjwt` (not `jwt`), the request property changed from `req.user` to `req.auth`, and `algorithms` is now required to prevent downgrade attacks. The package is maintained by Auth0 with quarterly releases.

web-framework auth-security

npm install express-jwt

github ↗package ↗

INSTALL

IMPORT

SIG · EXPRESS-JWT

express-jwt

web-frameworkjavascriptv8.5.1

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

expressjwt

✓ import { expressjwt } from 'express-jwt'

✗ import jwt from 'express-jwt'

v8+ exports only named `expressjwt`; default export was removed.

ExpressJwtRequest

✓ import { ExpressJwtRequest as RequestWithAuth } from 'express-jwt'

✗ import { RequestWithAuth } from 'express-jwt'

TypeScript only; re-exported as needed.

GetVerificationKey

✓ import type { GetVerificationKey } from 'express-jwt'

✗ import { GetVerificationKey } from 'express-jwt'

Type-only import to avoid runtime errors when not used as a value.

Shows basic usage: importing expressjwt, setting up a protected route with secret and algorithms, and accessing the decoded payload from req.auth.

import { expressjwt } from 'express-jwt'; import express from 'express'; const app = express(); // Protected route app.get( '/protected', expressjwt({ secret: process.env.JWT_SECRET ?? 'my-secret', algorithms: ['HS256'], }), (req, res) => { // Access payload via req.auth if (!req.auth.admin) return res.sendStatus(401); res.json({ message: 'Protected data', user: req.auth }); } ); // Public route app.get('/token', (req, res) => { res.send('No auth required'); }); app.listen(3000);

Debug

Known issues

breakingv8 changed the exported function from default export `jwt` to named export `expressjwt`.

fix

Replace `import jwt from 'express-jwt'` with `import { expressjwt } from 'express-jwt'`.

affects: >=8.0.0

breakingv8 changed the request property from `req.user` to `req.auth`.

fix

Access decoded payload via `req.auth` instead of `req.user`.

affects: >=8.0.0

gotchaThe `algorithms` option is required; not providing it will throw an error.

fix

Always pass `algorithms: ['HS256']` (or your chosen algorithm) in options.

affects: >=6.0.0

gotchaDo not mix symmetric and asymmetric algorithms (e.g., HS256 and RS256) as it can lead to downgrade attacks.

fix

Use only one set of algorithms (symmetric or asymmetric) and validate against the expected algorithms list.

affects: >=5.0.0

deprecatedThe `credentialsRequired` option defaulted to `true`; setting to `false` bypasses token validation entirely.

fix

If you want optional auth, consider using `.unless()` or handle missing tokens in your own middleware.

affects: >=7.0.0

Errors

Common errors & fixes

TypeError: jwt is not a function

Using default import on v8+ where only named export `expressjwt` exists.

fix

Change import to `import { expressjwt as jwt } from 'express-jwt'`

Error: secret must be a string or buffer

Providing an undefined or invalid `secret` option to expressjwt.

fix

Ensure secret is a non-empty string or Buffer, e.g., `secret: process.env.JWT_SECRET ?? 'fallback'`

Algorithms is not provided

Missing required `algorithms` option in expressjwt config.

fix

Add `algorithms: ['HS256']` (or your desired algorithm) to the options object.

Upgrade

Version history

8.5.1latest on npm

Audit

Dependencies

jsonwebtokenrequiredCore dependency for JWT verification; used internally and its secrets, algorithms, and options are passed through.

@types/expressoptionalProvides Express type definitions required for TypeScript users to correctly type the middleware and request extensions.

Agent activity

28 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/auth0/express-jwt ↗

packagehttps://www.npmjs.com/package/express-jwt ↗