diff --git a/packages/thumbnail-handler/src/index.ts b/packages/thumbnail-handler/src/index.ts
index 41e6ab640..da49bc8e4 100644
--- a/packages/thumbnail-handler/src/index.ts
+++ b/packages/thumbnail-handler/src/index.ts
@@ -228,14 +228,24 @@ export const findThumbnail = async (
 
 export const thumbnailHandler = Sentry.GCPFunction.wrapHttpFunction(
   async (req, res) => {
+    if (!process.env.JWT_SECRET) {
+      console.error('JWT_SECRET not exists')
+      return res.status(500).send('JWT_SECRET_NOT_EXISTS')
+    }
+
     const token = req.headers?.authorization
     if (!token) {
       console.debug('no token')
       return res.status(401).send('UNAUTHORIZED')
     }
-    const { uid } = jwt.decode(token) as { uid: string }
-    if (!uid) {
-      console.debug('no uid')
+    let uid = ''
+    try {
+      const decoded = jwt.verify(token, process.env.JWT_SECRET) as {
+        uid: string
+      }
+      uid = decoded.uid
+    } catch (e) {
+      console.debug('invalid token')
       return res.status(401).send('UNAUTHORIZED')
     }