HarperFast / HarperFast/harper
Role permissions assigned in JWTs are not actually enforced
Open
area:auth
bug
from-jira
- Dominant language
- JavaScript
- Stars
- 89
- Forks
- 10
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 200
Description
## Problem
CORE-2615 added the ability to embed a role in a signed JWT. However, the role assignment does not actually grant the privileges of that role — it can only be read, not enforced. JWT-embedded roles need to be applied to the request context so permissions are checked against them.
🤖 Filed by Claude on behalf of Kris.
Contributor guide
Assessment
This issue has not been assessed yet.