Steps to reproduce

• Enable JWT (https://doc.ibexa.co/en/latest/guide/security/#jwt-authentication)
• Generate a new token
• Perform REST call that uses POST method (for instance: create content)

Result

An exception about missing permissions is thrown.

Root cause

By its nature JWT is stateless. LoginListener starts session and therefore the operation is executed as anonymous user.