feat(auth): add HA-compatible sandbox JWT refresh replay protection
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 8.7k
- Forks
- 1.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 253
Description
Description
Implement HA-compatible replay protection for sandbox gateway JWT refresh. Gateway-minted sandbox tokens should carry a jti or refresh generation claim, and refresh handling should reject reused or stale credentials while remaining compatible with multiple gateway replicas.
Context
Follow-up from PR #1404 review point 4. This is separate from the immediate per-sandbox auth hardening because it needs a replicated or persistent refresh-state design.
Definition of Done
- Sandbox JWTs include a
jtior refresh generation claim. - Refresh validates the current generation using storage that works across gateway replicas.
- Refresh rotates or advances generation and rejects reused tokens after the chosen grace policy.
- Tests cover stale-token rejection, replay rejection, and multi-replica-compatible state behavior.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the sandbox gateway JWT refresh handling and PR #1404 review point 4; the payload does not name specific files or tests. Define the replicated or persistent refresh-state approach and its grace policy first. Done means JWTs carry generation data, refresh advances shared state, reused or stale tokens are rejected, and tests cover replay, staleness, and multi-replica behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- authentication, distributed-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100