mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-18 16:02:10 +00:00
Ruben Fiszel
e73770c247
Previously each API replica generated a random Ed25519 signing key at startup (unless DEBUG_SIGNING_KEY_SEED was set). In multi-replica deployments this caused "Invalid JWT signature" rejections in the multiplayer server: the browser could sign a token on pod A while `windmill-extra` had cached the JWKS public key from pod B. Derive the seed deterministically from the DB-backed JWT_SECRET using SHA-256 with a domain-separation tag so all pods agree without coordination. Re-derive on JWT_SECRET rotation. The DEBUG_SIGNING_KEY_SEED env var is still honored as an override. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
28 lines
632 B
TOML
28 lines
632 B
TOML
[package]
|
|
name = "windmill-api-debug"
|
|
version.workspace = true
|
|
authors.workspace = true
|
|
edition.workspace = true
|
|
|
|
[lib]
|
|
name = "windmill_api_debug"
|
|
path = "src/lib.rs"
|
|
|
|
[dependencies]
|
|
windmill-api-auth.workspace = true
|
|
windmill-common = { workspace = true, default-features = false }
|
|
windmill-audit.workspace = true
|
|
axum.workspace = true
|
|
base64.workspace = true
|
|
chrono.workspace = true
|
|
ed25519-dalek.workspace = true
|
|
hex.workspace = true
|
|
lazy_static.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
sha2.workspace = true
|
|
sqlx.workspace = true
|
|
tokio.workspace = true
|
|
tracing.workspace = true
|
|
uuid.workspace = true
|