guardian / guardian/pan-domain-node

Support smooth key-rotation, accept multiple public-keys

Open
#28 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
2
Forks
1
PR merge metrics
No merged PRs in 30d

Description

We're trying to work towards the ability to refresh the Panda key on a regular basis (eg weekly, or daily) and so we'll need `pan-domain-node` to handle that!

Work has already been completed in the Scala Panda library to support smooth-key rotation, by accepting multiple public-keys:

* https://github.com/guardian/pan-domain-authentication/pull/150

...we'll need to duplicate that work in `pan-domain-node`. This needs two main changes:

- [ ] Update the config parsing code in [`fetchPublicKey()`](https://github.com/guardian/pan-domain-node/blob/92e462a3527ccb1880f46ca2959cce5829367d60/src/fetch-public-key.ts#L10C17-L18) to read the additional public keys defined in `alsoAccept.X.publicKey` config entries (see [sample .settings files](https://github.com/guardian/pan-domain-authentication/tree/c211ad4da385ffcc3071a7047e915a99bb50d892/pan-domain-auth-verification/src/test/resources/crypto-conf-rotation-example))
- [ ] Update the cookie verification code in [`verifyUser()`](https://github.com/guardian/pan-domain-node/blob/92e462a3527ccb1880f46ca2959cce5829367d60/src/panda.ts#L34) to try each of those additional public keys in turn, rather than just the single active key

See also:

* https://github.com/guardian/data-science-recipes/issues/119

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.