why is x-hasura-default-role is prefered over x-hasura-role

Hi! Thank you for your awesome work.

I have an issue with jwt. While using this HASURA CLAIMS:

{ "x-hasura-default-role": "anonymous", "x-hasura-allowed-roles": [ "user", "anonymous", "admin", "institution-admin" ], "x-hasura-role": "user", "x-hasura-user-id": "rglCjqnVAKbBx0Q7jke73blCKmu1" }

Hasura identifies request sender as anonymous

When changed to this HASURA CLAIMS: { "x-hasura-default-role": "user", "x-hasura-allowed-roles": [ "user", "anonymous", "admin", "institution-admin" ], "x-hasura-role": "user", "x-hasura-user-id": "rglCjqnVAKbBx0Q7jke73blCKmu1" }

Hasura identifies request sender as user

Why can this be happening?

[0x777]

x-hasura-role has to be sent with the http request. It is not expected to be part of the JWT’s hasura claims and as such it is ignored. The x-hasura-role sent with the request is checked to see if it is part of the x-hasura-allowed-roles and if yes, the request is executed as that role. In case the x-hasura-role is missing, the x-hasura-default-role from the JWT is used.

[ifdotpy]

@dohomi Initially I also thought it is a security issue. But then realized that auth server should return correct role list (x-hasura-allowed-roles). Which means that the roles in the list are the only roles that can be put into x-hasura-role header.