# Spot the bug: Vue.js / Nuxt.js

> One snippet. Find the bug, or prove there isn't one.

Daily challenge: 2026-08-19 (UTC) · Mid-Level

```typescript
import jwt from 'jsonwebtoken'

export default defineEventHandler(async (event) => {
  const { refreshToken } = await readBody(event)

  const decoded = jwt.verify(refreshToken, process.env.REFRESH_SECRET!) as { userId: string; iat: number }

  if (Date.now() - decoded.iat * 1000 > 2592000000) {
    throw createError({ statusCode: 401, message: 'Refresh token expired' })
  }

  const newToken = jwt.sign(
    { userId: decoded.userId },
    process.env.JWT_SECRET!,
    { expiresIn: 3600 }
  )

  return { token: newToken }
})
```

## Your verdict

- Security flaw
- Logic bug
- Code style
- No issue

One attempt per day. The answer shows up right after.

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/en/daily/vue-nuxt