Return HTTP status 400 if missing JWT

[kitloong]

Fixes

echo-jwt/jwt.go

Lines 159 to 161 in 6944ffe

	// For valid token, it sets the user in context and calls next handler.
	// For invalid token, it returns "401 - Unauthorized" error.
	// For missing token, it returns "400 - Bad Request" error.

https://echo.labstack.com/docs/middleware/jwt

Should return HTTP status 400 if missing JWT as documented.

[kitloong]

Hi @aldas

I am sorry, just a kind reminder to review in case you have missed this, thank you!

[aldas]

LGTM

[CodingTil]

Hi, just wondering - why was the status code changed? I would heavily expect a 401, even more so after considering https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses.
I guess one could make the point that a malformed token should result in a 400.

The issue with 400 is: 400 is commonly used to signal that the response (body) itself is malformed. I would not expect a token related issue in a 400, but only in a 401 or 403.

[aldas]

to be honest I do not remember actual details but I would assume looking at the error messages - the reasoning was that for some cases ('header' for example) it would distinguish cases when you have incorrectly composed the requests (did not add jwt or added somewhere where middleware can not extract) from cases when you are sending unparseable/verifiable JWTs that failed cryptographic authentication.