hasura / hasura/graphql-engine

Enable setting for minimum request interval for JWK

Open
#9,005 4 comments 9 reactions 0 assignees View on GitHub
k/enhancement t/gql-services
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Is your proposal related to a problem?

I am using Keycloak as auth provider and Hasura to expose GraphQL queries. I am using jwk_url of `HASURA_GRAPHQL_JWT_SECRET` variable to provide Keycloak certs endpoint. Since response from Keycloak certs endpoint has no-cache in Cache-Contorl header, Hasura fetches JWK from Keycloak endpoint every second (https://hasura.io/docs/latest/auth/authentication/jwt/#rotating-jwks) which results in too many unnecessary requests from Hasura to Keycloak in the service. Similar issues were already discussed in https://github.com/hasura/graphql-engine/issues/8299. Therefore the following log appears every second.

```
hasura_1 | {"detail":{"error":null,"message":"refreshing JWK from endpoint: http://.../protocol/openid-connect/certs"},"level":"info","timestamp":"2022-09-26T08:16:24.257+0000","type":"jwk-refresh-log"}
```

### Describe the solution you'd like

Is it possible to make this configurable via environment variables like
- include this as part of `HASURA_GRAPHQL_EXPERIMENTAL_FEATURES` or,
- include this in the new property of `HASURA_GRAPHQL_JWT_SECRET` or,
- create a new environment variable `HASURA_GRAPHQL_MIN_TIME_BETWEEN_JWKS_REQUESTS`

With one of these options, Hasura can fetch the JWk from auth provider at a desired interval.

Contributor guide

Open the contributing guide

Research direction

Start with the JWT/JWK configuration represented by HASURA_GRAPHQL_JWT_SECRET and review the related discussion in issue #8299. Determine how a configurable minimum interval should interact with JWK refreshes, then verify that requests do not occur more frequently than the configured interval.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
api, authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.