hasura / hasura/graphql-engine
JWSError NoUsableKeys during startup
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
Server Version: hasura/graphql-engine:v2.22.0
### Environment: local docker
### What is the current behaviour?
I have a jwk_url set up in HASURA_GRAPHQL_JWT_SECRET
| Phase | Response |
| ------------------------------------- | ------------------------------------------------------ |
| startup | Socket closed |
| fetching jwk_url | Socket closed |
| fetching jwk_url (⚠️ second time) | Error: Could not verify JWT: JWSError NoUsableKeys |
| jwk_url response arrived (second time)| as expected |
### What is the expected behaviour?
fetch jwk_url only once, don't have a time period when hasura is accepting requests but returning `JWSError NoUsableKeys`
### How to reproduce the issue?
1. Point jwk_url to an endpoint that has an artificial 10 seconds delay before it responds
2. Start hasura
3. make a query with JWT auth
### Keywords
Could not verify JWT: JWSError NoUsableKeys
Contributor guide
Research direction
Start by reproducing the delayed jwk_url scenario in local Docker, using the HASURA_GRAPHQL_JWT_SECRET configuration and a 10-second response delay. Trace startup JWT key fetching and request handling to determine why a second fetch occurs and requests are accepted while no usable keys are available. Done means the endpoint is fetched once and JWT requests do not enter that intermediate failure period.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, graphql
- Domain
- authentication, backend-api-design, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100