hasura / hasura/graphql-engine

JWSError NoUsableKeys during startup

Open
#9,613 1 comment 0 reactions 0 assignees View on GitHub
k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: hasura/graphql-engine:v2.22.0

### Environment: local docker

### What is the current behaviour?

I have a jwk_url set up in HASURA_GRAPHQL_JWT_SECRET

| Phase | Response |
| ------------------------------------- | ------------------------------------------------------ |
| startup | Socket closed |
| fetching jwk_url | Socket closed |
| fetching jwk_url (⚠️ second time) | Error: Could not verify JWT: JWSError NoUsableKeys |
| jwk_url response arrived (second time)| as expected |

### What is the expected behaviour?

fetch jwk_url only once, don't have a time period when hasura is accepting requests but returning `JWSError NoUsableKeys`

### How to reproduce the issue?

1. Point jwk_url to an endpoint that has an artificial 10 seconds delay before it responds
2. Start hasura
3. make a query with JWT auth

### Keywords
Could not verify JWT: JWSError NoUsableKeys

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the delayed jwk_url scenario in local Docker, using the HASURA_GRAPHQL_JWT_SECRET configuration and a 10-second response delay. Trace startup JWT key fetching and request handling to determine why a second fetch occurs and requests are accepted while no usable keys are available. Done means the endpoint is fetched once and JWT requests do not enter that intermediate failure period.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, graphql
Domain
authentication, backend-api-design, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.