That is our server middleware, that check authentication:
auth.js
// Set up Auth0 configuration
const authConfig = {
domain: 'auth0_domain',
audience: 'auth0_audience',
};
// Define middleware that validates incoming bearer tokens
// using JWKS from YOUR_DOMAIN
module.exports = jwt({
secret: jwksRsa.expressJwtSecret({
cache: true,
rateLimit: true,
jwksRequestsPerMinute: 5,
jwksUri: `https://${authConfig.domain}/.well-known/jwks.json`,
}),
audience: authConfig.audience,
issuer: `https://${authConfig.domain}/`,
algorithm: ['RS256'],
})
This validation passed successfully and joined auth0 user data to request, like this:
req.user: {
iss: 'https://some-project.auth0.com/',
sub: 'auth0|someId',
aud: [
'https://some-project.com',
'https://some-project.auth0.com/userinfo'
],
iat: 1673300522,
exp: 1673386922,
azp: 'string',
scope: 'scopes'
}
We expect, that JWT check should not pass, because user already logged out on client.