Ruben Fiszel e73770c247 fix: derive debug signing key deterministically from JWT_SECRET (#8917) ...

Previously each API replica generated a random Ed25519 signing key at
startup (unless DEBUG_SIGNING_KEY_SEED was set). In multi-replica
deployments this caused "Invalid JWT signature" rejections in the
multiplayer server: the browser could sign a token on pod A while
`windmill-extra` had cached the JWKS public key from pod B.

Derive the seed deterministically from the DB-backed JWT_SECRET using
SHA-256 with a domain-separation tag so all pods agree without
coordination. Re-derive on JWT_SECRET rotation. The
DEBUG_SIGNING_KEY_SEED env var is still honored as an override.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-22 20:05:08 +00:00

..

src

fix: derive debug signing key deterministically from JWT_SECRET (#8917)

2026-04-22 20:05:08 +00:00

Cargo.toml

fix: derive debug signing key deterministically from JWT_SECRET (#8917)

2026-04-22 20:05:08 +00:00