Adicionando tempo de expiração do token e melhorando tratamento de segurança

middlewares/auth.js

@@ -2,13 +2,25 @@ const jwt = require('jsonwebtoken');
 const config = require('config');
 
 module.exports = (req, res, next) => {
-  const token = req.header('Authorization');
-  if (!token) {
+  const authHeader = req.header('Authorization');
+  if (!authHeader) {
     const err = new Error('Access denied. No token provided.');
     err.status = 401;
     return next(err);
   }
 
+  const parts = authHeader.split(' ');
+
+  if (!parts.length === 2) {
+    return res.status(401).send({ error: 'Token error' });
+  }
+
+  const [scheme, token] = parts;
+
+  if (!/^Bearer$/i.test(scheme)) {
+    return res.status(401).send({ error: 'Token Malformatted' });
+  }
+
   try {
     const decoded = jwt.verify(token, config.get('jwtPrivateKey'));
     req.user = decoded;

modules/tokenGenerator.js

@@ -2,7 +2,7 @@ const jwt = require('jsonwebtoken');
 const config = require('config');
 
 function sendToken (req) {
-  const token = jwt.sign({ username: req.body.username }, config.get('jwtPrivateKey'), { expiresIn: '7 days' });
+  const token = jwt.sign({ username: req.body.username }, config.get('jwtPrivateKey'), { expiresIn: 604800 });
   return token;
 }