do not throw exception when the payload is not json. related to #14

index.js

@@ -36,7 +36,7 @@ module.exports.verify = function(jwtString, secretOrPublicKey, options, callback
   if (!options) options = {};
 
   if (!jwtString)
-  	return callback(new JsonWebTokenError('jwt must be provided'));
+    return callback(new JsonWebTokenError('jwt must be provided'));
 
   var parts = jwtString.split('.');
   if (parts.length !== 3)
@@ -56,7 +56,13 @@ module.exports.verify = function(jwtString, secretOrPublicKey, options, callback
   if (!valid)
     return callback(new JsonWebTokenError('invalid signature'));
 
-  var payload = this.decode(jwtString);
+  var payload;
+
+  try {
+   payload = this.decode(jwtString);
+  } catch(err) {
+    return callback(err);
+  }
 
   if (payload.exp) {
     if (Math.floor(Date.now() / 1000) >= payload.exp)
@@ -82,7 +88,8 @@ var JsonWebTokenError = module.exports.JsonWebTokenError = function (message, er
   this.name = 'JsonWebTokenError';
   this.message = message;
   if (error) this.inner = error;
-}
+};
+
 JsonWebTokenError.prototype = Object.create(Error.prototype);
 JsonWebTokenError.prototype.constructor = JsonWebTokenError;
 

test/jwt.hs.tests.js

@@ -9,7 +9,7 @@ describe('HS256', function() {
     var secret = 'shhhhhh';
 
     var token = jwt.sign({ foo: 'bar' }, secret, { algorithm: 'HS256' });
-  
+
     it('should be syntactically valid', function() {
       expect(token).to.be.a('string');
       expect(token.split('.')).to.have.length(3);
@@ -49,5 +49,12 @@ describe('HS256', function() {
       });
     });
 
+    it.only('should throw when the payload is not json', function(done) {
+      var token = jwt.sign('bar', 'secret', { algorithm: 'HS256' });
+      jwt.verify(token, 'secret', function() {
+        done();
+      });
+    });
+
   });
 });