better error message

jwt.go

@@ -23,7 +23,7 @@ const (
 )
 
 var (
-	ErrNoJWT               = errors.New("no json web token")
+	ErrNoJWT               = errors.New("not a json web token")
 	ErrUnsupportedAlg      = errors.New("unsupported algorithm")
 	ErrInvalid             = errors.New("token validation failed")
 	ErrBlacklisted         = errors.New("token blacklisted")
@@ -278,6 +278,14 @@ func DecodeToken(token string) (t *Token, err error) {
 	if len(parts) < 3 {
 		return nil, ErrMissingTokenParts
 	}
+	if len(parts) > 3 {
+		return nil, ErrNoJWT
+	}
+	for _, v := range parts {
+		if v == "" {
+			return nil, ErrNoJWT
+		}
+	}
 	t = new(Token)
 	header, err := base64.URLEncoding.DecodeString(parts[0])
 	if err != nil {