search

ExpressGateway / express-gateway

A microservices API Gateway built on top of Express.js
https://www.express-gateway.io
Apache License 2.0
2.98k stars 348 forks source link

[Question] Does scope restriction apply with JWT policy ? #961

Closed claustres closed 4 years ago

claustres commented 5 years ago

According to the docs it seems that scope restriction should apply when using a controlled modality but we are not able to make it work. The controlled modality seems to be correctly enabled because if we issue a token with an invalid credential key in sub the request is rejected. However the scope restriction does not seem to apply when the token is valid because we always get access to all API endpoints, whatever the scopes defined on the target credential.

It seems that there are similar issues like https://github.com/ExpressGateway/express-gateway/issues/740 & https://github.com/ExpressGateway/express-gateway/issues/684 but all refering to the OAuth2 use case. We don't use OAuth2 but simply the JWT policy to check a token issued by another application so we are not sure if related.

XVincentX commented 4 years ago

I believe you're hitting exactly the same issue unfortunately. Closing in favour of these two.