Client mode does not work - Any Bearer token is valid

[ezze5]

Hello Community,

I need to trigger workflows and use the Rest API in a safe way so I created a new Role, Service account, and Role binding as explained in the documentation.

https://argoproj.github.io/argo-workflows/access-token/

After creating the token I noticed that even if the Bearer token was wrong I could log in in client mode to the UI or submit workflows via REST API, the only thing that is needed is that the token has "Bearer" at the beginning. Examples:

Bearer 1111
Bearer 112
Bearer 1132.

This makes the Argo server really unsafe.

Can someone advise here? Am I missing anything?

I am running Argo Workflows v3.0.1 on an AKS

Thanks in advance.