From ea4a1e2dc6093570e4876b9f2a29c6cecc17d6f4 Mon Sep 17 00:00:00 2001 From: omnom62 Date: Wed, 26 Aug 2026 17:10:31 +1000 Subject: http-api: T8989: address Copilot review comments - Remove fallback 'oidc-client' identity - tokens without sub/client_id are now rejected - Suppress OIDC validation error details from stdout - Cache discovered JWKS URI back to session to avoid per-request discovery - token_op now accepts X-API-Key header alongside form field - Reset REST/OIDC session attributes on SIGHUP reload to prevent stale config persisting after nodes are removed --- src/services/vyos-http-api-server | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'src/services/vyos-http-api-server') diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server index 64ac57499..6a420f499 100755 --- a/src/services/vyos-http-api-server +++ b/src/services/vyos-http-api-server @@ -182,6 +182,12 @@ def initialization(session: SessionState, app: FastAPI = app): session.keys = flatten_keys(server_config) rest_config = server_config.get('rest', {}) + # Reset REST auth settings on reload so removed config nodes don't persist in-memory + session.rest_token_exp = None + session.rest_secret_len = None + session.oidc_issuer = None + session.oidc_jwks_uri = None + session.oidc_audience = None session.debug = bool('debug' in rest_config) session.strict = bool('strict' in rest_config) if isinstance(rest_config, dict): -- cgit v1.2.3