From 558d4fd1f017673c2b7e42ad3f8e7aed72062a9c Mon Sep 17 00:00:00 2001
From: Nwatu Desmond <chinomsoedeh@yahoo.com>
Date: Mon, 28 Sep 2026 00:03:56 +0100
Subject: [PATCH] fix(auth): handle malformed access-token cookies

---
 src/auth/strategies/jwt.strategy.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/auth/strategies/jwt.strategy.ts b/src/auth/strategies/jwt.strategy.ts
index fe054d95..bf22c5a6 100644
--- a/src/auth/strategies/jwt.strategy.ts
+++ b/src/auth/strategies/jwt.strategy.ts
@@ -21,7 +21,13 @@ function cookieExtractor(req: Request): string | null {
   if (!header) return null;
   for (const part of header.split(';')) {
     const [rawKey, ...rest] = part.trim().split('=');
-    if (rawKey === 'access_token') return decodeURIComponent(rest.join('='));
+    if (rawKey === 'access_token') {
+      try {
+        return decodeURIComponent(rest.join('='));
+      } catch {
+        return null;
+      }
+    }
   }
   return null;
 }