06-jwt-expired
Stale credentials used
Expired JWT
JWT with exp in the past. Envoy's jwt_authn filter rejects before ext_authz runs.
jwtdenyexpired
FIXTURE
tenant_id"acme-turkiye"
home_region"tst"
scopes
ai.chat.write
exp1000000000
iat999999000
Defaults: iss = http://localhost/tst-issuer, aud = edge, exp = now+1h, kid = tester-rs256
EXPECTED OUTCOME
HTTP STATUS401
BYPASSES OPAREJECTED BEFORE EXT_AUTHZ — OPA NOT CONSULTED
What this demonstrates
A request arrives with expired credentials. Expired-credential acceptance is how leaked old tokens become breaches; here it's refused before the AI ever runs.
Identity & access management
RUNNER
Execute scenario
Mints a JWT, sends the request through the live Envoy, and compares the response against the expected outcome.
Requires the PolicyGate stack reachable on host ports 10000 / 8181.
WHY THIS MATTERS
Proves the JWT verification gate enforces token expiry.