GSHE Auth Canary Cloudflare Pages
Verifies Cf-Access-Jwt-Assertion in a Pages Function using
@gshe-apps/access-jwt, then reports who you are, what you may do, and
whether the gated routes actually enforce it.
Verification
Checking…
Who you are
What you may do
From the roles claim — Entra app roles. The last segment splits the two
tiers: gshe.<app>.access is admission, anything else
is RBAC.
Enforcement
Live probes, not predictions — the SPA actually calls each gated route. A
403 here beside a populated role list above means the role is unassigned in
Entra.
MFA
Tri-state. Unknown means the gateway is not forwarding amr — a
config gap, not evidence MFA did not happen. It also describes the
original sign-in, so it is not a step-up check.