{"record":{"id":"60e6117deb03b71d","repo":"gchq/CyberChef","slug":"verified-message","errorCode":null,"errorMessage":"${verified.message}","messagePattern":"\\$\\{verified\\.message\\}","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/JWTVerify.mjs","lineNumber":52,"sourceCode":"            },\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const [key] = args;\n        const algos = JWT_ALGORITHMS;\n        algos[algos.indexOf(\"None\")] = \"none\";\n\n        try {\n            const verified = jwt.verify(input, key, { algorithms: algos });\n\n            if (Object.prototype.hasOwnProperty.call(verified, \"name\") && verified.name === \"JsonWebTokenError\") {\n                throw new OperationError(verified.message);\n            }\n\n            return verified;\n        } catch (err) {\n            throw new OperationError(err);\n        }\n    }\n\n}\n\nexport default JWTVerify;\n","sourceCodeStart":34,"sourceCodeEnd":64,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/JWTVerify.mjs#L34-L64","documentation":"Thrown by JWT Verify on a specific code path where jsonwebtoken's verify() returns (rather than throws) an object whose name is 'JsonWebTokenError'. The operation detects this returned-error shape and re-throws verified.message. This covers structural/signature JWT errors such as 'jwt malformed' or 'invalid signature' in library versions that return instead of throw.","triggerScenarios":"A token with an invalid signature (wrong key). A malformed token that the library surfaces as a returned JsonWebTokenError rather than a thrown one. Token where the algorithm is not in the allowed list and the library returns the error object.","commonSituations":"Verifying with the wrong secret/key. Verifying a token signed with an algorithm excluded from the allowed list. Library version differences where some errors are returned vs thrown.","solutions":["Provide the exact secret (HMAC) or PEM public key (RSA/ECDSA) the token was signed with.","Ensure the token's alg is in the allowed algorithm set.","Re-sign the token with the key you control and re-verify to isolate key vs token problems.","Upgrade/align jsonwebtoken versions if the returned-error behavior is inconsistent."],"exampleFix":"// before: wrong secret\nchef.JWTVerify(token, { key: 'wrong-secret' });\n// after: correct secret used to sign\nchef.JWTVerify(token, { key: 'correct-secret' });","handlingStrategy":"try-catch","validationCode":"function preflightVerify(token, key, algos) {\n  if (typeof token !== 'string' || token.split('.').length !== 3)\n    throw new Error('Not a compact JWT');\n  if (!key) throw new Error('A secret/public key is required');\n}","typeGuard":"function isVerifiableToken(s) {\n  return typeof s === 'string' && s.split('.').length === 3 &&\n    s.split('.').every(p => /^[A-Za-z0-9_-]*$/.test(p));\n}","tryCatchPattern":"try {\n  return chef.JWTVerify(token, { key });\n} catch (e) {\n  if (/invalid signature|jwt malformed/i.test(String(e.message)))\n    throw new Error('Signature/key mismatch or malformed token');\n  throw e;\n}","preventionTips":["Use the exact secret/PEM public key that signed the token.","Ensure the token's alg is in the allowed list.","Re-sign and re-verify to isolate key vs token problems."],"tags":["jwt","crypto","key","verification"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}