Change from 1.5.6 to 2.0.0 and appears a "Completed 401 Unauthorized"

[glarrai1]

I just "bundle update", and the this error starts appearing while invoking: before_action :authenticate_user!

Im' using device 4.3.0 and jwt gems for authentication.

My code is:

class UsersController < ApplicationController
  before_action :authenticate_user!

  (...)
end

# Helper module for you to use on your app and in your Strategy
# Don't add "Helper" to its name and rails won't load it has a view helper module.
# "app/helpers/jwt_wrapper.rb"

module JWTWrapper
  extend self

  def encode(payload, expiration = nil)
    expiration ||= Rails.application.secrets.jwt_expiration_minutes

    payload = payload.dup
    payload['exp'] = expiration.to_i.minutes.from_now.to_i

    JWT.encode payload, Rails.application.secrets.secret_key_base
  end

  def decode(token)
    begin
      decoded_token = JWT.decode token, Rails.application.secrets.secret_key_base

      decoded_token.first
    rescue
      nil
    end
  end
end

# Use this hook to configure devise mailer, warden hooks and so forth.
# Many of these configuration options can be set straight in your model.
Devise.setup do |config|
  (...)

  config.warden do |manager|
    # Registering your new Strategy
    manager.strategies.add(:jwt, Devise::Strategies::JsonWebToken)

    # Adding the new JWT Strategy to the top of Warden's list,
    # Scoped by what Devise would scope (typically :user)
    manager.default_strategies(scope: :user).unshift :jwt
  end

  (...)
end

# Your actual JWT Strategy
# "config/initializers/core_extensions/devise/strategies/json_web_token.rb"

module Devise
  module Strategies
    class JsonWebToken < Base
      def valid?
        request.headers['Authorization'].present?
      end

      def authenticate!
        return fail! unless claims
        return fail! unless claims.has_key?('user_id')

        success! User.find_by_id claims['user_id']
      end

      protected ######################## PROTECTED #############################

      def claims
        strategy, token = request.headers['Authorization'].split(' ')

        return nil if (strategy || '').downcase != 'bearer'

        JWTWrapper.decode(token) rescue nil
      end
    end
  end
end

[glarrai1]

Any idea?, thanks!

[excpt]

Hi @glarrai1,

thanks for the detailed report. Please make sure your exp claim is an unix timestamp and the decode method no longer provides a default algorithm. Please make sure to set a algorithm when decoding the token.

For further debugging help I recommend to open a ticket on the devise repository.

Sorry to hear that you run into troubles.

[glarrai1]

Thanks @excpt , including the algorithm explicit (using the default one anyway; 'HS256'); now the last 2.0.0 version works ;)