# Auth0 token - Node Jsonwebtoken - Cloudflare Workers

**URL:** <https://community.auth0.com/t/auth0-token-node-jsonwebtoken-cloudflare-workers/84916>\
**Category:** Get Help\
**Created:** [June 9, 2022, 11:35pm UTC](https://community.auth0.com/t/auth0-token-node-jsonwebtoken-cloudflare-workers/84916 "2022-06-09T23:35:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tools1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/tools1/32/33383_2.png) [@tools1](https://community.auth0.com/u/tools1)\
**Post date:** [June 9, 2022, 11:35pm UTC](https://community.auth0.com/t/auth0-token-node-jsonwebtoken-cloudflare-workers/84916/1 "2022-06-09T23:35:30Z")

</div>

Hello!

1. I’m using the react auth0 provider to get an Auth0 token.
2. I’m taking this TOKEN and passing it via url param (as a test for now, eventually it would be a header) and try to decode it using jsonwebtoken verify function
3. The token is not getting verified.

This is my code (I’m setting type = “webpack” in my wrangler.toml so I can import modules):

```auto
import { verify } from 'jsonwebtoken'

addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

async function handleRequest(request) {
  const url = new URL(request.url)
  const { searchParams } = url
  let token = searchParams.get('token')

  if (url.pathname === '/auth') {
    try {
      verify(
        token,
        STRING_SECRET,
        { algorithms: ['RS256'] },
        function(err, payload) {
          console.log('payload', err, payload)
        },
      )
    } catch (err) {
      console.log('error decoding', err.message, err.name)
    }
  }

  return new Response('No response', {
    headers: { 'content-type': 'text/plain' },
  })
}

```

The console.log(‘payload’, err, payload) is not showing an _err_ or a _payload_ . This is what the Cloudflare logs are showing:

```auto
"logs": [
    {
      "message": [
        "payload",
        {},
        null
      ],
      "level": "log",
      "timestamp": 1654695913617
    }
  ],

```

How can I verify this token? Appreciate any ideas.

Thank you!

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [June 16, 2022, 9:39pm UTC](https://community.auth0.com/t/auth0-token-node-jsonwebtoken-cloudflare-workers/84916/3 "2022-06-16T21:39:12Z")

</div>

Hi @tools1,

Welcome to the Auth0 Community!

Are you seeing a valid token in your worker? You can print it and decode manually using [jwt.io](http://jwt.io).

Is your secret set up correctly? You may want to consider fetching it directly from your tenant using the code snippet here:

> <https://github.com/auth0/node-jsonwebtoken/blob/master/README.md?plain=1#L217>

---

<div class="post-metadata">

**Author:** ![benstechlab](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/benstechlab/32/38923_2.png) [@benstechlab](https://community.auth0.com/u/benstechlab)\
**Post date:** [July 25, 2022, 9:05pm UTC](https://community.auth0.com/t/auth0-token-node-jsonwebtoken-cloudflare-workers/84916/4 "2022-07-25T21:05:41Z")

</div>

Hi @dan.woda, FYI the provided solution above doesn’t actually work in Cloudflare Workers - but at no fault of Auth0. The `node-jsonwebtoken` and `jwks-rsa` packages require nodejs builtins and globals. Cloudflare Workers is nodejs “like”, but not actually full nodejs apis. They do offer the ability to turn on a compatibility mode which uses `https://github.com/ionic-team/rollup-plugin-node-polyfills/` to emulate all the nodejs stuff. But sadly it still fails with the `jwks-rsa` package.

The most obvious dependency here is using the nodejs `http` and `https` libraries to make requests instead of the `fetch` api which are now standardized in all browsers and nodejs \>=17.5. The same would apply to the nodejs crypto module vs browser JS crypto APIs.

Also FYI, Cloudflare removed their Workers+Auth0 blog post/sample this year due to a security flaw (I think it was not validating the JWT after it was returned from authorization server). So there is no good samples available today for CloudFlare+Auth0.

Ideally, the auth0 packages would be updated to have the option of using browser native APIs for http requests and crypto. But I realize that may not be a quick/easy task.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [July 25, 2022, 9:22pm UTC](https://community.auth0.com/t/auth0-token-node-jsonwebtoken-cloudflare-workers/84916/5 "2022-07-25T21:22:41Z")

</div>

@benstechlab Thanks for the added info!

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [December 22, 2022, 10:57am UTC](https://community.auth0.com/t/auth0-token-node-jsonwebtoken-cloudflare-workers/84916/6 "2022-12-22T10:57:27Z")

</div>