The lookupToken function doesn't seem to receive the cookie options.

[chiptoma]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the bug has not already been reported

Fastify version

4.24.3

Plugin version

No response

Node.js version

20.10

Operating system

macOS

Operating system version (i.e. 20.04, 11.3, 10)

16.2

Description

When setting the plugin to only look for the token in the cookies and with the cookieName specified it fails to look there.

While checking the lookupToken function it seems that there is the following test which will fail every time as the cookie variable is not defined.

else if (cookie) {
      if (request.cookies) {
        if (request.cookies[cookie.cookieName]) {
          const tokenValue = request.cookies[cookie.cookieName]

          token = cookie.signed ? request.unsignCookie(tokenValue).value : tokenValue
        } else {
          throw new NoAuthorizationInCookieError()
        }
      } else {
        throw new BadCookieRequestError()
      }

Steps to Reproduce

Try to define the options as below:

fastify.register(fastifyJwt, {
    secret: JWT_SECRET,
    cookie: {
      cookieName: JWT_COOKIE,
      signed: true,
    },
    sign: {
      expiresIn: JWT_EXPIRES_IN,
    },
    onlyCookie: true,
    messages: jwtMessages,

    ...opts.fastifyJwt,
  })

Expected Behavior

To find the token in the request.cookies[JWT_COOKIE].

[mcollina]

Thanks for reporting!

Can you provide steps to reproduce? We often need a reproducible example, e.g. some code that allows someone else to recreate your problem by just copying and pasting it. If it involves more than a couple of different file, create a new repository on GitHub and add a link to that.

[CatfoodHeist]

I too am seeing this issue. I'm using @fastify/cookie with @fastify/jwt, and the cookies property is never initialized. I believe this is fallout from a change in @fastify/cookie #248

[gurgunday]

I too am seeing this issue. I'm using @fastify/cookie with @fastify/jwt, and the cookies property is never initialized. I believe this is fallout from a change in @fastify/cookie #248

In that PR, there is no change to the behavior of the function

[eEQK]

workaround for now:

const SESSION_COOKIE_NAME = 'whatever';

export async function verifyJwt(
	this: FastifyInstance,
	req: FastifyRequest,
	rep: FastifyReply,
) {
	try {
		// biome-ignore lint/suspicious/noExplicitAny: workaround
		(req as any).cookies = {
			session: req.headers.cookie
				?.split('; ')
				.find((row) => row.startsWith(SESSION_COOKIE_NAME))
				?.split('=')[1],
		};
		await req.jwtVerify();
	} catch (err) {
		return rep.send(this.httpErrors.unauthorized('invalid token'));
	}
}