title: Issue with retrieval of the cert/secret for JWT authentication. (Node/Express/C#/IdentityServer)
body: <p>I am having an issue with validating the JWT on the server side end of my node/express app. The token is being generated in Identity Server in an asp.net core app. The token that is generated is an RS256 token type, which means a private key and public key need to be generated on creation in the Identity Server. What that means for me - </p>
  
  <p>On the client side (Angular) I'm passing in the Bearer token on all requests once signed in. I need to authenticate that token somehow. The way to do that with a RS256 token type is to make sure the public key matches. I'm using </p>
  
  <blockquote>
    <p>const jwt2 = require('jwt-simple');</p>
  </blockquote>
  
  <p>For my JWT validation. </p>
  
  <p>The issue is the secret, here is the jwt-simple documentation <a href="https://github.com/hokaccha/node-jwt-simple" rel="noreferrer">jwt-simple link</a>. If I make the third value in decode false it works, because it's ignoring the secret/cert that is required. </p>
  
  <p>I'm getting this error - </p>
  
  <blockquote>
    <p>Error: error:0906D06C:PEM routines:PEM_read_bio:no start line</p>
  </blockquote>
  
  <p>I'm making this validation in the middleware so all endpoints will hit it. 
  I saw this issue - <a href="https://stackoverflow.com/questions/22584268/node-js-https-pem-error-routinespem-read-biono-start-line">SO Similar Issue</a> and ran those same commands. I'm still getting the error because the token doesn't really have anything to do with the certs because I'm getting it from the Identity Server project. So I need to retrieve the cert public key from that project. </p>
  
  <p>How would I be able to send that cert in the token or retrieve that valid cert somehow? Hopefully, this made some sense. Any help would be appreciated. </p>
  
  <p>v1 - (using the self signed server.crt as the cert and getting this error)</p>
  
  <blockquote>
    <p>Error: Signature verification failed</p>
  </blockquote>
  
  <p>App.js</p>
  
  <pre><code>//This is for a self-signed certificate locally with no correlation to the token itself.
  const options = {
      key: fs.readFileSync('./key.pem', 'utf8'),
      cert: fs.readFileSync('./server.crt', 'utf8')
   };
  
  app.use((req, res, next) =&gt; {
      if(!req.headers.authorization){
          return res.status(403).json({ error: 'No credentials sent!'});
      } else {
          let token = req.headers.authorization.split(' ')[1]
  
          var decoded = jwt.decode(token, options.cert);
  
          if(decoded){
              let currentTime = new Date().getTime()/1000
              if(decoded.exp &lt;= currentTime){
                  return res.status(403).json({
                      error: 'Token has expired'
                  }); 
              }
          }
          else if(!decoded){
              return res.status(403).json({
                  error: 'invalid token'
              }); 
          }
      }
      next();
  })
  </code></pre>
  
  <p>v2 - (using random text as the cert and getting this error)</p>
  
  <blockquote>
    <p>Error: error:0906D06C:PEM routines:PEM_read_bio:no start line</p>
  </blockquote>
  
  <p>App.js</p>
  
  <pre><code>app.use((req, res, next) =&gt; {
      if(!req.headers.authorization){
          return res.status(403).json({ error: 'No credentials sent!'});
      } else {
          let token = req.headers.authorization.split(' ')[1]
          var secret = new Buffer('newsecret').toString('base64')
          var decoded = jwt2.decode(token, secret);
          if(decoded){
              let currentTime = new Date().getTime()/1000
              if(decoded.exp &lt;= currentTime){
                  return res.status(403).json({
                      error: 'Token has expired'
                  }); 
              }
          }
          else if(!decoded){
              return res.status(403).json({
                  error: 'invalid token'
              }); 
          }
      }
      next();
  })
  </code></pre>
  
  <p>So it seems I need a cert with the right signature that matches what was generated with the token. </p>
  
  <p>JWT.io parsed token structure - </p>
  
  <p>Header</p>
  
  <pre><code>{
    "alg": "RS256",
    "kid": "1231231231231231231",
    "typ": "JWT",
    "x5t": "si7bdXd6......HnxhO4Wi_s"
  }
  </code></pre>
  
  <p>Do I do anything with x5t? Apologies for the long post. Thanks.</p>