Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

jwt.verify is not async based on callback

Open
#984 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
javascript, node.js
Domain
backend, security

Research direction

Read the documented jwt.verify callback behavior and inspect verify.js around line 101, especially how secretOrPublicKey affects execution. Determine whether the intended contract is asynchronous callback timing or documentation of the current behavior; done means the implementation and documentation agree on the observed ordering.

Written by the indexing model from the issue text.

Description

Description

jwt.verify(token, secretOrPublicKey, [options, callback])
(Asynchronous) If a callback is supplied, function acts asynchronously. The callback is called with the decoded payload if the signature is valid and optional expiration, audience, or issuer are valid. If not, it will be called with the error.
(Synchronous) If a callback is not supplied, function acts synchronously. Returns the payload decoded if the signature is valid and optional expiration, audience, or issuer are valid. If not, it will throw the error.

Based on the doc, if a callback is supplied, function acts asynchronously. However, it is still a sync operation, considering the following example

jwt.verify(
  'token',
  'secret',
  () => {
    console.log(1);
  }
)
console.log(0);
// 1
// 0

I would expect it's 1 after 0 if it does async operation.

By looking at the implementation, looks like whether or not jwt.verify does async operation is purely based on the behaviour in secretOrPublicKey when it's provided as a function.

https://github.com/auth0/node-jsonwebtoken/blob/bc28861f1fa981ed9c009e29c044a19760a0b128/verify.js#L101

Dominant language
JavaScript
Stars
18.2k
Forks
1.3k
PR merge metrics
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from auth0/node-jsonwebtoken

All issues in auth0/node-jsonwebtoken

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.