EG should differentiate the error between unauthorized and invalid token

[djesani]

Currently, if an authenticated endpoint is hit with no access_token, an "UNAUTHORIZED" error is returned, which is correct behaviour.

However, if I hit the same endpoint with a valid access_token but that token has expired, I should get a different error such as "INVALID_TOKEN".

The code must already doing checks against the token to determine its expired, so I presume at that point EG should return a different error.

I think this could be linked in with issue #692 .

[XVincentX]

They're not linked issues. #692 is about proxy errors — this is an authentication error that's handle per policy.

To close this issue there are couple of modifications needed in both JWT verifier policy as well as the opaque token verification.