What causes "The route {0} is not permitted with JWT authentication." in passbolt/passbolt_api?

Use the JWT-appropriate endpoint instead of the blocked route (e.g. DELETE the JWT itself rather than /auth/logout)

passbolt/passbolt_api · error · BadRequestException

The route is not permitted with JWT authentication.

Error message

The route {0} is not permitted with JWT authentication.

What it means

Thrown by JwtRouteFilterMiddleware::throwExceptionIfRouteIsNotAllowedWithJwtAuth (invoked from process). Certain legacy routes that rely on session/cookie auth are deliberately blocked when the request is a JWT-auth request, returning a 400 naming the route.

Solutions

Use the JWT-appropriate endpoint instead of the blocked route (e.g. DELETE the JWT itself rather than /auth/logout)
Perform session-based auth (login without JWT) when calling the blocked routes
Review getBlockedRoutes() in JwtRouteFilterMiddleware to see which routes are JWT-forbidden
Update the client to the protocol-mandated endpoints for JWT authentication

Example fix

// before (with JWT token)
POST /auth/logout
// after
POST /auth/jwt/logout  (or discard the JWT client-side)

Defensive patterns

Strategy: validation

Validate before calling

const blockedRoutes = ['/auth/logout', '/users/abuseReports', /* see getBlockedRoutes */];
if (usingJwt && blockedRoutes.some(r => path.startsWith(r))) useSessionAuthInstead();

Try / catch

try { await api(path, { token: jwt }); } catch (e) { if (String(e.message).includes('not permitted with JWT authentication')) { reauthWithSession(path); } }

Prevention

Know which routes are session-only and never call them with a bearer JWT
Use the JWT logout/dispose flow instead of session logout
Keep clients updated with protocol changes

When it happens

Trigger: A request authenticated with a JWT bearer token hits one of the routes returned by getBlockedRoutes() (e.g. /auth/logout, /users/me/settings-type endpoints that require session auth).

Common situations: Client uses a JWT access token to call session-only routes (e.g. logout or csrf-protected endpoints); frontend partially migrated between auth modes; API clients mixing session cookies and JWT in one session.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/19871edf6b10d45b. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/JwtAuthentication/src/Middleware/JwtRouteFilterMiddleware.php:75

        return [
            '/auth/login',
            '/auth/logout',
        ];
    }

    /**
     * Checks that the request is JWT related, and throws an exception if the required routes are not allowed.
     *
     * @param \Cake\Http\ServerRequest $request Request
     * @return void
     * @throws \Cake\Http\Exception\BadRequestException
     */
    protected function throwExceptionIfRouteIsNotAllowedWithJwtAuth(ServerRequest $request): void
    {
        if ($request->getAttribute(JwtRequestDetectionService::IS_JWT_AUTH_REQUEST)) {
            $route = $request->getAttribute('params')['_matchedRoute'] ?? null;
            if (in_array($route, $this->getBlockedRoutes())) {
                throw new BadRequestException(
                    __('The route {0} is not permitted with JWT authentication.', $route)
                );
            }
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)