Cloud & Security · Developer Error Resolution Lab

Fix JWT Error: 'JsonWebTokenError: jwt malformed' or 'jwt expired'

Handle authorization header parsing, Bearer prefix stripping, and token expiration gracefully.

Fix Guide:

Triggered Error Message:

JsonWebTokenError: jwt malformed

Customize Solution for Your Environment

Secret Environment Variable

import jwt from "jsonwebtoken";

export function authenticateToken(authHeader: string | undefined) {
  if (!authHeader || !authHeader.startsWith("Bearer ")) {
    throw new Error("UNAUTHORIZED_MISSING_HEADER");
  }

  const token = authHeader.slice(7).trim();
  if (!token) throw new Error("UNAUTHORIZED_EMPTY_TOKEN");

  try {
    return jwt.verify(token, process.env.JWT_SECRET!);
  } catch (error: any) {
    if (error.name === "TokenExpiredError") throw new Error("TOKEN_EXPIRED");
    throw new Error("TOKEN_INVALID");
  }
}

Root Cause & Mechanism Analysis

Why does this error occur?

Passing the string `'Bearer <token>'` directly into `jwt.verify()` without splitting the `'Bearer '` prefix, passing an empty string, or using an expired token.