Node.js and TypeScript Tutorial: Secure an Express API

[malikmahmud]

The latest version of the express-jwt package stores the decoded jwt payload in “req.auth” not “req.user”. The express-jwt-authz looks for your scopes on the req.user object by default (which will be undefined). Try updating the “checkPermissions” function like this: