auth0/node-jsonwebtoken — pull request #24 by marwanhilmi (2014-09-05 04:26:14+00:00)
Title: Verifying null fix.

When using either socketio-jwt or express-jwt middlewares, if the token provided by the client is null, you'll have an unhandled crash because of an attempt to call .split('.') on null. Line 41 in the modified source, [Line 38 in original source](https://github.com/auth0/node-jsonwebtoken/blob/master/index.js#L38).

Since you cannot expect clean input from the client, this is probably a security issue. You can easily crash a server with express-jwt middleware by setting your Authorization header to "Bearer ".

Optionally, the value can be validated prior to calling verify but I believe this is a safer fix.

jwt.verify in express-jwt: https://github.com/auth0/express-jwt/blob/master/lib/index.js#L46
jwt.verify in socketio-jwt: https://github.com/auth0/socketio-jwt/blob/master/lib/index.js#L23