title: extract payload of expired jwt token
body: <p>I am making API Server with Node.js and Express.</p>
  
  <p>Also I used JWT token authentication for auth user.</p>
  
  <p>If token is expired, my scenario is here.</p>
  
  <ol>
  <li><p><code>(Backend) Middleware detect expired</code></p></li>
  <li><p><code>(Frontend) Receive token is expired</code></p></li>
  <li><p><code>(Fronend) Refresh token request to backend</code></p></li>
  <li><p><code>(Backend) Verify token is valid and if it expired, sign new token(with old token's payload) and response it to frontend</code></p></li>
  </ol>
  
  <p>at number 4, my code is here.</p>
  
  <pre><code>try {
      const token = req.headers.authorization.split(' ')[1];
      jwt.verify(token, SECRET, (err, decoded) =&gt; {
          if(err.name === 'TokenExpiredError') {
              const payload = jwt.verify(token, SECRET);
              const userid = payload.userid;
              const is_admin = payload.is_admin;
  
              const refreshToken = jwt.sign({
                  userid: userid,
                  is_admin: is_admin
              }, SECRET, {
                  algorithm: 'HS256',
                  expiresIn: '10m'
              })
              res.status(200).json({status: true, token: refreshToken});
          }
          else if(err) {
              res.status(401).json({status: false, result: "Invalid token"});
          }
      })
  } catch(e) {
      //console.log(e);
      res.status(401).json({status: false, result: "Token does not exist"});
  }
  </code></pre>
  
  <p>After run it, throw errors line of <code>const payload = jwt.verify(token, SECRET);</code>.</p>
  
  <p>Because if token is expired, it throws <code>TokenExpiredError</code> error.</p>
  
  <p>I want to decode token and extract payload of expired token.</p>
  
  <p>But in <code>verify()</code>, there is no information about payload.</p>
  
  <p>So I read document, found some interest method <code>decode()</code>.</p>
  
  <p>But it mention that do not use <code>decode()</code>, because it doesn't check signature is correct or not.</p>
  
  <p>Is there any solution about extract payload of expired token?</p>
  
  <p>Thanks.</p>