Expected behavior upon JWT verification failure

[hojoungjang]

I am not sure what should happen when the verification using jose.jwtVerify(...) fails (i.e. the given JWT is invalid).
Can you please provide some examples? Do we simply catch errors like this?

const jwtPubKey = "..."
const key = await jose.importSPKI(jwtPubKey, "RS256");
try {
  const { payload, protectedHeader } = await jose.jwtVerify(token, key);
} catch (error) {
  console.log(error);
}

For my use case, I need to determine when the verification fails.

I assume there are different scenarios for verification failures (ex. expired JWT, signature mismatch and so on).
Will catching the error cover all cases where the JWT is invalid?

[panva]

The returned promise will only resolve when everything's in order. In all other cases the promise will reject.

[hojoungjang]

Got it, thanks!