From ea4a1e2dc6093570e4876b9f2a29c6cecc17d6f4 Mon Sep 17 00:00:00 2001 From: omnom62 Date: Wed, 26 Aug 2026 17:10:31 +1000 Subject: http-api: T8989: address Copilot review comments - Remove fallback 'oidc-client' identity - tokens without sub/client_id are now rejected - Suppress OIDC validation error details from stdout - Cache discovered JWKS URI back to session to avoid per-request discovery - token_op now accepts X-API-Key header alongside form field - Reset REST/OIDC session attributes on SIGHUP reload to prevent stale config persisting after nodes are removed --- src/services/api/rest/libs/token_auth.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'src/services/api/rest/libs') diff --git a/src/services/api/rest/libs/token_auth.py b/src/services/api/rest/libs/token_auth.py index ea0b14a9c..e0710cc20 100644 --- a/src/services/api/rest/libs/token_auth.py +++ b/src/services/api/rest/libs/token_auth.py @@ -46,6 +46,7 @@ def verify_oidc_token(token: str): disc_url = f"{state.oidc_issuer}/.well-known/openid-configuration" with _req.urlopen(disc_url, timeout=10) as r: jwks_uri = _json.loads(r.read())["jwks_uri"] + state.oidc_jwks_uri = jwks_uri jwks_client = PyJWKClient(jwks_uri, cache_keys=True) signing_key = jwks_client.get_signing_key_from_jwt(token) decode_options = {"require": ["exp"]} @@ -60,9 +61,8 @@ def verify_oidc_token(token: str): else: decode_options["verify_aud"] = False payload = jwt.decode(token, signing_key.key, **decode_kwargs) - return payload.get("sub") or payload.get("client_id") or "oidc-client" - except Exception as e: - print(f"OIDC token validation failed: {e}", flush=True) + return payload.get("sub") or payload.get("client_id") + except Exception: return None -- cgit v1.2.3