jsonwebtoken verify fails when the secret is directly provided in the program
<p>I am trying to verify and decode a json web token using jsonwebtoken npm, using the following code snippet:</p>

<pre><code>var jwt = require('jsonwebtoken');
var fs = require('fs');

var encoded = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6IjEiLCJsb2dpbklkIjoicm9vdCIsInVzZXJOYW1lIjoicm9vdCIsInJvbGUiOiIwIiwic3RhdHVzIjoiMSIsInBhc3N3b3JkIjoiYWNiM2UxNDFkODgzMTA2ZGUyZjMwZDQ2ZTc2YzA5Y2YiLCJuYW1hayI6InJvb3QiLCJsYXN0TG9naW5UaW1lIjoibnVsbCIsImVtYWlsIjoicm9vdEBlY3AuY29tdml2YS5jb20iLCJjb250YWN0Tm8iOiIwMTIzNDU2Nzg5IiwiYXV0aFR5cGUiOiJudWxsIiwicGFyZW50SWQiOiJudWxsIiwibGFuZ3VhZ2UiOiJudWxsIiwiY3VycmVuY3kiOiJudWxsIiwiYWN0aXZhdGlvbkR0IjoibnVsbCIsImV4cGlyeUR0IjoibnVsbCIsImRlbGV0ZWRBdCI6Im51bGwiLCJwZXJtcyI6IntcIiVcIjo3fSIsImJhbGFuY2UiOiIxMjk5IiwiY2FjaGVkIjp0cnVlLCJpYXQiOjE0NTcxMDA5MjZ9.yn2Vb3hE7BKrXntCa-pTVAS7MwsaHD1csPZMiibOhwk';

fs.readFile('/etc/jwt/shared.key', function(err, result){
  if (err) {
    console.error("error:", err);
    return;
  }
  var verified = jwt.verify(encoded, 'ssshhhh');
  //var verified = jwt.verify(encoded, result);
  console.log("verified:", verified);
});
</code></pre>

<p>When I try to jwt.verify(), using a hardcoded value, the program fails </p>

<pre><code>     if (err) throw err;
                     ^
JsonWebTokenError: invalid signature
    at Object.JWT.verify (/home/rvnath/projects/comviva/mbs/ecp7/dev/authserver/node_modules/jsonwebtoken/index.js:219:17)
    at /home/rvnath/projects/comviva/mbs/ecp7/dev/authserver/testverify.js:11:22
    at fs.js:334:14
    at FSReqWrap.oncomplete (fs.js:95:15)
</code></pre>

<p>However, if I read the secret key file (instead of hardcoding) and supply to the verify function, it works correctly.  Here is the output of the program in this case:</p>

<pre><code>rvnath@rv ~/projects/comviva/mbs/ecp7/dev/authserver $ node testverify.js 
verified: { id: '1',
  loginId: 'root',
  userName: 'root',
  role: '0',
  status: '1',
  password: 'acb3e141d883106de2f30d46e76c09cf',
  namak: 'root',
  lastLoginTime: 'null',
  email: 'root@ecp.ecp.com',
  contactNo: '0123456789',
  authType: 'null',
  parentId: 'null',
  language: 'null',
  currency: 'null',
  activationDt: 'null',
  expiryDt: 'null',
  deletedAt: 'null',
  perms: '{"%":7}',
  balance: '1299',
  cached: true,
  iat: 1457100926 }
</code></pre>

<p>My secret file is a simple text file, shown below:</p>

<pre><code>rvnath@rv ~ $ cat /etc/jwt/shared.key 
ssshhhh
rvnath@rv ~ $ 
</code></pre>

<p>In summary, I am trying to decode by using the same secret key as stored in the file /etc/jwt/shared.key, but it fails when the key value is hardcoded in the program.  What am I doing wrong here?</p>

<p><strong>Edit</strong>
The jwt is being generated by my server app, by reading the secret from the same file:</p>

<pre><code>/** Creates a signed JSON WEB TOKEN **/
function createJWT(user) {
  return fs.readFileAsync('/etc/jwt/shared.key').then(function(cert){
    var secret = cert.toString();
    console.log("shared secret:", secret);
    var token = jwt.sign(user, secret);
    //console.log("token verification:",jwt.verify(token, cert));
    return token;
  });
}
</code></pre>