fix(auth): kid-first JWT verification, drop per-attempt debug logging (#11)

Browse Source

validateToken logged one line per JWKS key per request (a leftover DEBUG line
plus a per-failed-key line) — with multi-brand certs that produced a log line
per brand cert per request, ~4.4M lines/12h in production, and brute-forced
every key on every call. Now: verify against the key the token's kid header
names (single signature check in the common case), fall back across the
remaining keys only on rotation skew, and emit no per-attempt logs — the
returned error carries the diagnosis.

Co-authored-by: hanzo-dev <dev@hanzo.ai>

...

This commit is contained in:

z

2026-07-04 11:50:16 -07:00

committed by GitHub

co-authored by hanzo-dev

parent ec13c353fb

commit 9b0d48d836

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

Diff Content Not Available