Mercurial > p > roundup > code
comparison doc/rest.txt @ 7809:be6cb2e0d471
feat: add support for rotating jwt keys
This allows jwt_secret to have multiple ',' separated secrets. The
first/leftmost should be used to sign new JWTs. All of them are used
(starting from left/newest) to try to verify a JWT.
If the first secret is < 32 chars in length JWTs are disabled. If any
of the other secrets are < 32 chars, the configuration code causes the
software to exit. This prevents insecure (too short) secrets from
being used.
Updated doc examples and tests.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 14 Mar 2024 19:04:19 -0400 |
| parents | af898d1d66dc |
| children | ee0062411160 |
comparison
equal
deleted
inserted
replaced
| 7808:6c5f8da9fca7 | 7809:be6cb2e0d471 |
|---|---|
| 2069 raise UsageError("Role %s is not permitted."%role) | 2069 raise UsageError("Role %s is not permitted."%role) |
| 2070 | 2070 |
| 2071 claim['roles'] = newroles | 2071 claim['roles'] = newroles |
| 2072 else: | 2072 else: |
| 2073 claim['roles'] = user_roles | 2073 claim['roles'] = user_roles |
| 2074 secret = self.db.config.WEB_JWT_SECRET | 2074 |
| 2075 # Sign with newest/first secret. | |
| 2076 secret = self.db.config.WEB_JWT_SECRET[0] | |
| 2075 myjwt = jwt.encode(claim, secret, algorithm='HS256') | 2077 myjwt = jwt.encode(claim, secret, algorithm='HS256') |
| 2076 | 2078 |
| 2077 # if jwt.__version__ >= 2.0.0 jwt.encode() returns string | 2079 # if jwt.__version__ >= 2.0.0 jwt.encode() returns string |
| 2078 # not byte. So do not use b2s() with newer versions of pyjwt. | 2080 # not byte. So do not use b2s() with newer versions of pyjwt. |
| 2079 result = {"jwt": b2s(myjwt), | 2081 result = {"jwt": b2s(myjwt), |
| 2088 if not 'jwt' in input: | 2090 if not 'jwt' in input: |
| 2089 raise UsageError("jwt key must be specified") | 2091 raise UsageError("jwt key must be specified") |
| 2090 | 2092 |
| 2091 myjwt = input['jwt'].value | 2093 myjwt = input['jwt'].value |
| 2092 | 2094 |
| 2093 secret = self.db.config.WEB_JWT_SECRET | 2095 secret = self.db.config.WEB_JWT_SECRET[0] |
| 2096 | |
| 2097 # only return decoded result if the newest signing key | |
| 2098 # is used. Have older keys report an invalid signature. | |
| 2094 try: | 2099 try: |
| 2095 result = jwt.decode(myjwt, secret, | 2100 result = jwt.decode(myjwt, secret, |
| 2096 algorithms=['HS256'], | 2101 algorithms=['HS256'], |
| 2097 audience=self.db.config.TRACKER_WEB, | 2102 audience=self.db.config.TRACKER_WEB, |
| 2098 issuer=self.db.config.TRACKER_WEB, | 2103 issuer=self.db.config.TRACKER_WEB, |