`CognitoExpress.validate()`'s `callback` parameter is optional, but is blindly invoked for error conditions

This means that the promisified code path in `CognitoExpress.validate()` is fundamentally broken for failure scenarios.

Here are the offending lines:

https://github.com/ghdna/cognito-express/blob/86c738624b52a4de2e9e4df7bf10289564c3ae01/lib/strategy.js#L52-L63

Meanwhile, just a little further down `callback` is properly checked in two locations:

https://github.com/ghdna/cognito-express/blob/86c738624b52a4de2e9e4df7bf10289564c3ae01/lib/strategy.js#L72-L89


	if (!decodedJwt) return callback(`Not a valid JWT token`, null);

	if (decodedJwt.payload.iss !== this.iss)
	return callback(`token is not from your User Pool`, null);

	if (decodedJwt.payload.token_use !== this.tokenUse)
	return callback(`Not an ${this.tokenUse} token`, null);

	let kid = decodedJwt.header.kid;
	let pem = this.pems[kid];

	if (!pem) return callback(`Invalid ${this.tokenUse} token`, null);

	if (callback) {
	jwtVerify(params, callback);
	} else {
	return new Promise((resolve, reject) => {
	jwtVerify(params, (err, result) => {
	if (err) {
	reject(err);
	} else {
	resolve(result);
	}
	});
	});
	}
	});

	if (!callback) {
	return p;
	}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

`CognitoExpress.validate()`'s `callback` parameter is optional, but is blindly invoked for error conditions #18

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

CognitoExpress.validate()'s callback parameter is optional, but is blindly invoked for error conditions #18

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

`CognitoExpress.validate()`'s `callback` parameter is optional, but is blindly invoked for error conditions #18