Possible security vulnerability when multiple values passed in expectedScopes about express-jwt-authz

[Irrelon]

Surely this is correct behaviour though? Since the scopes should be a logical OR not an AND.

[saulimus]

Then that should be documented and not implied.

[Irrelon]

@saulimus Makes sense. Would you like to put in a PR for the updated doc?

[akehir]

Actually, this library uses arrays of arrays of strings for the logical AND, and arrays of strings for a logical OR.

// Required: "read" OR "write"
app.use(guard.check([
  ['read'],
  ['write']
]))

// Required: "admin" OR ("read" AND "write")
app.use(guard.check([
  ['admin'],
  ['read', 'write']
]))

To me, it makes sense to have both options.

[akehir]

Actually, I just realized, one can just verify multiple scopes like this:

// create retrieve endpoint endpoint
app.get('/endpoint', checkJwt, jwtAuthz(['READ']), jwtAuthz(['WRITE']), function (req, res) {
  // code that retrieves the user's balance and sends it back to the calling app

  res.status(201).send({message: "{\"message\": \"This is the GET /endpoint endpoint\""});
});

Therefore probably it's ok to leave the implementation as is, and update the documentation.