Insufficient scope error caused by undefined field in jwtAuthz about express-jwt-authz

[bjornol]

Same issue here on versions

"express": "^4.18.1",
"express-jwt": "^7.7.5",
"express-jwt-authz": "^2.4.1"

Solution from afilazzola works.

The problem is caused by the express-jwt v6 upgrade where the decoded JWT payload is now available as req.auth rather than req.user. See migration points (Migration from v6) in the express-jwt description. https://github.com/auth0/express-jwt

[henryspivey]

I'm getting the same error, "Insufficient Scope" as mentioned above
I am running:
"express": "^4.18.1",
"express-jwt": "^7.7.5",
"express-jwt-authz": "^2.4.1",

As suggested above, doing let userKey = 'auth' fixed the issue.

[luisr-carrillo]

As you commented, customUserKey: 'auth' fixed the issue.

But I have to change my Auth0 API settings, on the API dashboard then 'RBAC Settings' I actived 'Enable RBAC' and 'Add Permissions in the Access Token'.

This is my final config.
export const checkPermissions = (permissions: string[]) => { return jwtAuthz(permissions, { customScopeKey: 'permissions', customUserKey: 'auth' }); };

[danielwagn3r]

I've noticed this error as well. However in my case, I didn't use any additional properties in the JWT for RBAC or other stuff, I just used the standard scope parameter to check for client permissions (in my case it's a m2m use-case).

Didn't get it working with this package and therefore looked at https://github.com/benrei/express-jwt-scope

Used this versions:
"express": "^4.18.1",
"express-jwt": "^7.7.5",
"express-jwt-authz": "^2.4.1",

[FSou1]

Same.

Make sure you use express-jwt, because express-jwt-authz depends on that package under the hood.