How do I make sure that the request my EBS is getting, is genuinely them?

Extensions
3

So I’ve tried what I can. Here’s what I’m doing:

CLIENT:

  socket.emit('draw', {
    x: mouseX+1,
    y: mouseY+1,
    color: color,
    token: auth.token
  })

SERVER:

var secret = Buffer.from('SECRET', 'base64');

socket.on('draw', function (data) {
jwt.verify(data.token, secret, function (err, decoded) {
  if (err) {
    console.log(err);
  } else {
    console.log('is good' + decoded);
  }
})
})

and I’m still getting the “JsonWebTokenError: invalid signature” error. Any suggestions?