starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-05 16:03:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: correct the guest JWT minting instructions in the embed block

Browse Source 
The block said "sign it with the workspace's guest JWT key", but that setting
holds the public verification key. Clarify the keypair relationship (configure
the public key or a JWKS URL in the workspace; sign with the matching private
key), name the accepted algorithms (RS/PS/ES; HS* refused), and keep the
required claims, so an embedder knows how to actually mint the token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-09-05 09:53:09 +02:00
co-authored by Claude Opus 4.8
parent c20f549fe0
commit 59b45ea0ac
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/lib/components/apps/editor/AppEditorHeaderDeploy.svelte
+6 -3
View File
@@ -559,9 +559,12 @@
account, unlike the plain secret URL above.
</div>
<div class="text-xs text-secondary">
Sign it with the workspace's guest JWT key (Workspace settings → Guests), carrying
<code>email</code>, <code>workspace_id</code> = <code>{opWs}</code>,
<code>app_path</code> = <code>{appPath}</code> and <code>exp</code> (at most 24h ahead).
Set the <b>public</b> half of your signing keypair as the workspace's guest JWT key
(Workspace settings → Guests) — a PEM public key or a JWKS URL. In your backend, sign each
token with the matching <b>private</b> key using RS256/384/512, PS256/384/512 or ES256/384
(symmetric HS* is refused), carrying <code>email</code>,
<code>workspace_id</code> = <code>{opWs}</code>, <code>app_path</code> =
<code>{appPath}</code> and <code>exp</code> (at most 24h ahead).
</div>
<ClipboardPanel
content={toEmbedSnippet(`${guestJwtBase}/guest.YOUR_GUEST_JWT`)}