Istio policy to deny expired JWT access tokens - istio

Question

How can I define an Istio policy for my service to deny any request with a JWT access token that is expired?
For context, I have a Spring Boot KNative service with RequestAuthentication config that has checks for the token issuer.

Answer 1

Istio does that by default. Any JWT token that is expired, or otherwise invalid is denied by default.
However, for JWT token authorization to work, authorization policy must be configured.
Source for the below examples
Create AuthorizationPolicy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: require-jwt
namespace: foo
spec:
selector:
matchLabels:
app: httpbin
action: ALLOW
rules:
- from:
- source:
requestPrincipals: ["testing#secure.istio.io/testing#secure.istio.io"]
Get the valid JWT token
TOKEN=$(curl https://raw.githubusercontent.com/istio/istio/release-1.11/security/tools/jwt/samples/demo.jwt -s) && echo "$TOKEN" | cut -d '.' -f2 - | base64 --decode -
Verify that the request with valid token is allowed
kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c sleep -n foo -- curl "http://httpbin.foo:8000/headers" -sS -o /dev/null -H "Authorization: Bearer $TOKEN" -w "%{http_code}\n"
Adjust the above examples to your needs
If, for some reason, Istio does allow expired or otherwise invalid tokens, you should check your previously applied policies, to make sure nothing overrides default behaviour.