isJWT

1/**
2 * Checks if a string is a valid JSON Web Token (JWT).
3 *
4 * A valid JWT has three parts separated by dots and each part must be a valid Base64Url string.
5 *
6 * @param token - The string to check.
7 * @returns True if the string is a valid JWT, false otherwise.
8 */
9export function isJWT(token: string): boolean {
10  if (typeof token !== 'string') return false;
11
12  const parts = token.split('.');
13  if (parts.length !== 3) return false;
14
15  const base64urlRegex = /^[A-Za-z0-9\-_]+$/;
16  return parts.every(part => base64urlRegex.test(part));
17}

1test('valid JWT structure', () => {
2  const token =
3    'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9' + '.' +
4    'eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ' + '.' +
5    'SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
6  expect(isJWT(token)).toBe(true);
7});
8
9test('invalid JWT - wrong number of parts', () => {
10  expect(isJWT('one.two')).toBe(false);
11  expect(isJWT('one.two.three.four')).toBe(false);
12});
13
14test('invalid JWT - non-base64url characters', () => {
15  const token = 'eyJ@#$.eyJzdWIiOiIxMjM0.NzkwIiwiaWF0IjoxNTE2MjM5MDIyfQ';
16  expect(isJWT(token)).toBe(false);
17});
18
19test('non-string input returns false', () => {
20  expect(isJWT(null as any)).toBe(false);
21  expect(isJWT(undefined as any)).toBe(false);
22  expect(isJWT(123 as any)).toBe(false);
23});