ForwardAuth middleware missing native token expiry validation

Answer

Traefik’s ForwardAuth middleware only inspects the HTTP status code returned by the external authentication service. It does not parse or validate JWT claims such as exp, aud, or scope. Therefore, an expired or insufficiently scoped token will be forwarded to the backend unless the external service rejects it with a non‑2xx status code.

Typical configuration patterns

There are two common ways to enforce token validity when using ForwardAuth:

1. External‑service‑only validation: Configure the auth service to inspect the JWT and return 401 or 403 for expired or out‑of‑scope tokens. Traefik forwards the request only when the service replies with a 2xx status.
2. Pre‑auth JWT middleware: Insert Traefik’s JWT authentication middleware (available as a plugin in 2.x or built‑in in 3.x) before ForwardAuth. This middleware validates exp, aud, and scope locally and rejects the request before it reaches ForwardAuth.

Example configuration – Traefik 2.x (plugin)

http:
  routers:
    api:
      rule: "Host(`api.example.com`)
      entryPoints: [websecure]
      middlewares: [jwt-auth, forward-auth]
      service: api

  middlewares:
    jwt-auth:
      plugin:
        jwt:
          secret: <your‑jwt‑secret>
          algorithms: [HS256]
          audiences: ["api.example.com"]
          scopes: ["read:api", "write:api"]

    forward-auth:
      forwardAuth:
        address: https://auth.example.com/verify
        trustForwardHeader: true
        authResponseHeaders: ["X-User-Id", "X-User-Name"]

Example configuration – Traefik 3.x (built‑in JWT)

http:
  routers:
    api:
      rule: "Host(`api.example.com`)
      entryPoints: [websecure]
      middlewares: [jwt, forward-auth]
      service: api

  middlewares:
    jwt:
      jwt:
        secret: <your‑jwt‑secret>
        algorithms: [HS256]
        audiences: ["api.example.com"]
        scopes: ["read:api", "write:api"]

    forward-auth:
      forwardAuth:
        address: https://auth.example.com/verify
        trustForwardHeader: true
        authResponseHeaders: ["X-User-Id", "X-User-Name"]

Verification steps

• Generate a JWT with an exp in the past or a scope that does not match the required permissions.
• Send a request through Traefik with this token in the Authorization header.
• Confirm that Traefik returns a 401 or 403 and that the backend does not receive the request.
• If using a JWT middleware, check the order of log entries to verify that the request is rejected before ForwardAuth is invoked.

When Traefik can natively reject expired tokens

In Traefik 3.x the jwt middleware performs local validation of the exp claim. It is not part of ForwardAuth but can be chained before it. Traefik 2.x does not provide native JWT validation within ForwardAuth; you must use the plugin or the external auth service.

Missing diagnostic detail

Which Traefik major version are you running? If you are on 3.x you can use the built‑in JWT middleware; if you are on 2.x you need the plugin or rely solely on the external service.