Why public demo api server return HTTP Status 500 when unauthorized.

[CodeIdeal]

The server: api.realworld.io/api

Shouldn't it be 401?

[geromegrignon]

Hi @CodeIdeal, please provide the affected endpoint as 500 means an error occured.

[CodeIdeal]

curl -i -X "POST" "https://api.realworld.io/api/articles" \
     -H 'Content-Type: application/json' \
     -H 'X-Requested-With: XMLHttpRequest' \
     -H 'Authorization: Token' \
     -d $'{
  "article": {
    "body": "Very carefully.",
    "title": "How to train your dragon",
    "tagList": [
      "training",
      "dragons"
    ],
    "description": "Ever wonder how?"
  }
}'

[geromegrignon]

thanks, I'll investigate today

[geromegrignon]

i'll spend more time on it later on today with my laptop but i suspect this part:

const getTokenFromHeaders = (req: { headers: { authorization: string } }): string | null => {
  if (
    (req.headers.authorization && req.headers.authorization.split(' ')[0] === 'Token') ||
    (req.headers.authorization && req.headers.authorization.split(' ')[0] === 'Bearer')
  ) {
    return req.headers.authorization.split(' ')[1];
  }
  return null;
};

The naive approach expects by design a token if a authorization header including Token is found.
But as your header only includes Token, it fails to find the value of the token (aka req.headers.authorization.split(' ')[1]).

[CodeIdeal]

It doesn't seem to be just a problem here, because even if I don't add the authorization header, it still returns 500.

curl -i "https://api.realworld.io/api/user" \
     -H 'Content-Type: application/json' \
     -H 'X-Requested-With: XMLHttpRequest'

[geromegrignon]

I didn't notice express-jwt doesn't deal with such errors by design.
I pushed changes to catch them manually, it should work as expected now.