Review: JWT Verification Middleware Written by an AI Assistant

Published 10 Nov, 2026

Your team asked an AI coding assistant to replace a third-party JWT library with a small in-house helper and an Express middleware for the customer support API. It opened this pull request. You are the reviewer, and nothing merges without your approval.

The assistant's description:

Removes the JWT dependency. verifyJwt checks the signature, issuer and expiry and supports both HS and RS algorithms, so we are ready if the identity provider changes how it signs. requireAuth(["admin"]) protects routes by role. No behaviour change for callers.

Where it runs: Node 20 and Express 4. The company identity provider signs every token with RS256, using one key pair for all internal apps; each app gets its own aud value, and roles mean different things in different apps. The provider's public key is published on the intranet. Logs go to a shared platform that most engineers can read.

Your task

Flag every problem you would block the merge for. Click a line number to comment, and Shift-click to cover a range.
For each one, choose the issue type and severity, and explain what fails and how to fix it.
You are scored on the problems you catch, the right issue type and a clear explanation. Missing a critical problem fails the round.

Aim for 15 minutes, as in a real review round.

The algorithm comes from the token header, which the sender writes. What key is used when the header says HS256, and who already has that key?

What happens if IDP_PUBLIC_KEY is missing from the environment?

A token issued by the same provider for the staff canteen app arrives here. Which check stops it?

Compare how the HMAC signature is checked with how you would check a password hash.

Some tokens may not carry exp. How long do they last? And what ends up in the logs when a token is rejected?

A strong reviewer blocks this immediately: anyone can mint an admin token with the public key, because the code lets the token choose its own algorithm.

Algorithm confusion (jwt.ts lines 37–38, critical). The algorithm is taken from the attacker-controlled header, and the same key is used for both branches. An attacker sets "alg": "HS256" and signs the token with HMAC, using the identity provider's public key PEM as the secret. The server computes the same HMAC and accepts it. Pin the allowed algorithm (RS256) per key and reject everything else, or use crypto.createPublicKey so the key type decides the algorithm.
Empty key fallback (requireAuth.ts line 6, major). If the environment variable is missing, the key is "". Combined with the HS branch, a token signed with an empty HMAC secret is then valid. Fail at start-up when the key is not set.
Audience never checked (jwt.ts line 47, major). All internal apps share the provider's signing key, so a valid token issued for any other app is accepted here, and its role claim, which means something else in that app, is trusted. Check that aud contains this API's identifier.
Timing-unsafe signature comparison (jwt.ts line 39, major). === stops at the first differing character, so response timing can leak how much of a forged HMAC is correct. Compare with crypto.timingSafeEqual on equal-length buffers.
Tokens without exp never expire (jwt.ts line 50, minor). A missing exp skips the check, so such a token is valid for ever. Require exp, and allow a small clock skew.
Bearer tokens written to shared logs (requireAuth.ts line 29, minor). A rejected token may still be valid elsewhere (for another audience, or a few seconds of clock skew), and the logs are widely readable. Log the reason and perhaps the sub or a hash, never the token.

import crypto from "node:crypto";

export interface Claims {
  sub: string;
  role: "customer" | "support" | "admin";
  iss: string;
  aud: string | string[];
  exp?: number;
  iat?: number;
}

function decodeSegment<T>(segment: string): T {
  return JSON.parse(Buffer.from(segment, "base64url").toString("utf8")) as T;
}

function hmac(alg: string, data: string, secret: string): string {
  const hash = "sha" + alg.slice(2); // HS256 -> sha256
  return crypto.createHmac(hash, secret).update(data).digest("base64url");
}

/**
 * Verifies a JWT and returns its claims. Works with both HMAC (HS256/384/512)
 * and RSA (RS256/384/512) tokens, taking the algorithm from the token header,
 * so the identity provider can change its signing method without a code change.
 * Throws if the token is malformed, has a bad signature, has the wrong issuer
 * or has expired.
 */
export function verifyJwt(token: string, key: string, issuer: string): Claims {
  const parts = token.split(".");
  if (parts.length !== 3) throw new Error("Malformed token");
  const [headerB64, payloadB64, signature] = parts;

const header = decodeSegment<{ alg: string; typ?: string }>(headerB64);
  const signingInput = `${headerB64}.${payloadB64}`;

let valid: boolean;
  if (header.alg.startsWith("HS")) {
    const expected = hmac(header.alg, signingInput, key);
    valid = expected === signature;
  } else {
    const hash = "sha" + header.alg.slice(2);
    valid = crypto.verify(hash, Buffer.from(signingInput), key, Buffer.from(signature, "base64url"));
  }
  if (!valid) throw new Error("Invalid signature");

const claims = decodeSegment<Claims>(payloadB64);
  if (claims.iss !== issuer) throw new Error("Wrong issuer");

const now = Math.floor(Date.now() / 1000);
  if (claims.exp !== undefined && claims.exp < now) {
    throw new Error("Token expired");
  }
  return claims;
}

import type { Request, Response, NextFunction } from "express";
import { verifyJwt, Claims } from "./jwt";
import { logger } from "./logger";

// PEM-encoded public key of the company identity provider.
const IDP_PUBLIC_KEY = process.env.IDP_PUBLIC_KEY ?? "";
const IDP_ISSUER = process.env.IDP_ISSUER ?? "corp-idp";

declare global {
  namespace Express {
    interface Request {
      user?: Claims;
    }
  }
}

/** Rejects requests without a valid token, and optionally checks the role. */
export function requireAuth(roles: Claims["role"][] = []) {
  return (req: Request, res: Response, next: NextFunction) => {
    const token = (req.headers.authorization ?? "").replace(/^Bearer /, "");
    try {
      const claims = verifyJwt(token, IDP_PUBLIC_KEY, IDP_ISSUER);
      if (roles.length > 0 && !roles.includes(claims.role)) {
        return res.status(403).json({ error: "Forbidden" });
      }
      req.user = claims;
      next();
    } catch (err) {
      logger.warn("Rejected token", { token, reason: (err as Error).message });
      res.status(401).json({ error: "Unauthorised" });
    }
  };
}

{"issues":[
{"id": "alg-confusion", "file": "src/auth/jwt.ts", "lines": [37, 38], "category": "security", "severity": "critical", "title": "Token header chooses the algorithm, allowing HS256 forgery with the public key", "explanation": "The alg comes from the attacker's header and the same key feeds both branches. Signing an HS256 token with the public RSA key PEM as the HMAC secret passes verification, so anyone can mint any role.", "keywords": ["algorithm confusion", "alg", "header", "hs256", "rs256", "public key", "hmac", "whitelist", "allowlist", "pin", "forge"], "fix": "Pin the expected algorithm (RS256) for this key and reject any other alg, or use a KeyObject so the key type fixes the algorithm."},
{"id": "empty-key", "file": "src/auth/requireAuth.ts", "lines": [6, 6], "category": "security", "severity": "major", "title": "Missing key silently falls back to an empty string", "explanation": "If IDP_PUBLIC_KEY is unset the key is \"\", and an HS256 token signed with an empty HMAC secret then verifies. Misconfiguration should stop the service, not weaken it.", "keywords": ["empty", "fallback", "default", "env", "missing", "fail fast", "start-up", "startup", "unset"], "accept": ["design"], "fix": "Throw at start-up when IDP_PUBLIC_KEY is not set."},
{"id": "audience", "file": "src/auth/jwt.ts", "lines": [47, 47], "category": "security", "severity": "major", "title": "Audience claim is never checked", "explanation": "Every internal app's tokens share the provider's key and issuer, so a token issued for another app passes, and its role claim is trusted here.", "keywords": ["aud", "audience", "other app", "another app", "intended", "recipient"], "accept": ["api"], "fix": "Check that aud equals or contains this API's identifier."},
{"id": "timing", "file": "src/auth/jwt.ts", "lines": [39, 39], "category": "security", "severity": "major", "title": "HMAC compared with ===", "explanation": "String equality returns as soon as a character differs, so timing can reveal how much of a forged signature is correct.", "keywords": ["timing", "timingsafeequal", "constant time", "constant-time", "side channel", "side-channel"], "fix": "Compare with crypto.timingSafeEqual on buffers of equal length."},
{"id": "no-exp", "file": "src/auth/jwt.ts", "lines": [50, 50], "category": "edge", "severity": "minor", "title": "Tokens without exp are valid for ever", "explanation": "When exp is missing the expiry check is skipped, so such a token never expires; there is also no allowance for clock skew.", "keywords": ["exp", "expiry", "never expire", "forever", "for ever", "required", "missing", "skew"], "accept": ["security"], "fix": "Require exp to be a number and reject tokens without it; allow a small clock skew."},
{"id": "log-token", "file": "src/auth/requireAuth.ts", "lines": [29, 29], "category": "security", "severity": "minor", "title": "Raw bearer token written to shared logs", "explanation": "A rejected token may still be valid for another app or after clock skew, and the shared logs are readable by many people.", "keywords": ["log", "token", "secret", "leak", "credential", "redact", "sensitive"], "fix": "Log the reason and a non-sensitive id or hash, never the token itself."}
]}

Topics #009 AI Code Review Authentication Express Medium Node.js Security TypeScript