With the token from chapter 49, authenticated requests can NOW be made – the standard HTTP mechanism for this is called Authorization: Bearer.

Testing a request without a token

curl -k -i https://localhost/api/projects

HTTP/2 401

{
  "code": 401,
  "message": "JWT Token not found"
}

BECAUSE of access_control with IS_AUTHENTICATED_FULLY (chapter 49), the ENTIRE /api area NOW requires a VALID token – that was the INTENDED effect of the firewall configuration.

Sending the token along

curl -k -H "Authorization: Bearer $TOKEN" https://localhost/api/projects

NOW 200 OK – the Authorization header with the Bearer prefix (ONE space, then the token) authenticates the request.

Simulating an expired token

JWT tokens have a DEFAULT validity of ONE hour (configurable via lexik_jwt_authentication.yaml, the token_ttl parameter) – after expiring, EVERY request returns the SAME 401 error as WITHOUT a token, with the message "Expired JWT Token".

Using Swagger UI with a token

The Swagger UI from chapter 6 offers an "Authorize" button where the token can be ENTERED – AFTERWARD, ALL interactive test calls are AUTOMATICALLY authenticated, WITHOUT re-entering the header on every click.