Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(auth): Added trimming to jwt secret token read from .jwt_secret #16467

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from

Conversation

MkSavin
Copy link

@MkSavin MkSavin commented Feb 11, 2025

Proposed change

Not cleaning leading and trailing spaces when reading a secret token from a file results in JWT tokens being generated with an incorrect secret.

When building a mini-app that works with the Frigate API, it was noticed that JWT tokens were being generated with a secret other than the one specified in the .jwt_secret file. After several hours of painstaking reverse engineering, it was discovered that the secret token reading functionality also reads spaces and special characters that appear when manually editing the file (for example, via nano).

This PR adds cleaning of spaces and special characters when reading the secret.

There are no breaking and critical changes. But the change will cause all users to logout from the system, since the algorithm for obtaining a secret token will be changed.

Type of change

  • Dependency upgrade
  • Bugfix (non-breaking change which fixes an issue)
  • New feature
  • Breaking change (fix/feature causing existing functionality to break)
  • Code quality improvements to existing code
  • Documentation Update

Additional information

I injected logging in the auth() method and got the following results.

Before changes:
Before changes

After changes:
After changes

.jwt_secret file were created manually via nano.

Checklist

  • The code change is tested and works locally.
  • Local tests pass. Your PR cannot be merged unless tests pass
  • There is no commented out code in this PR.
  • The code has been formatted using Ruff (ruff format frigate)

Added cleaning of leading and trailing spaces and special characters from a line when reading a secret token from a `.jwt_secret` file
Copy link

netlify bot commented Feb 11, 2025

Deploy Preview for frigate-docs ready!

Name Link
🔨 Latest commit c9d9aa9
🔍 Latest deploy log https://app.netlify.com/sites/frigate-docs/deploys/67aac07cae279d00085b4457
😎 Deploy Preview https://deploy-preview-16467--frigate-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant