[Question] Does scope restriction apply with JWT policy ?

[claustres]

According to the docs it seems that scope restriction should apply when using a controlled modality but we are not able to make it work. The controlled modality seems to be correctly enabled because if we issue a token with an invalid credential key in sub the request is rejected. However the scope restriction does not seem to apply when the token is valid because we always get access to all API endpoints, whatever the scopes defined on the target credential.

It seems that there are similar issues like #740 & #684 but all refering to the OAuth2 use case. We don't use OAuth2 but simply the JWT policy to check a token issued by another application so we are not sure if related.

[XVincentX]

I believe you're hitting exactly the same issue unfortunately. Closing in favour of these two.