fix(auth): Added trimming to jwt secret token read from .jwt_secret #16467
+1
−1
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed change
Not cleaning leading and trailing spaces when reading a secret token from a file results in JWT tokens being generated with an incorrect secret.
When building a mini-app that works with the Frigate API, it was noticed that JWT tokens were being generated with a secret other than the one specified in the
.jwt_secret
file. After several hours of painstaking reverse engineering, it was discovered that the secret token reading functionality also reads spaces and special characters that appear when manually editing the file (for example, vianano
).This PR adds cleaning of spaces and special characters when reading the secret.
There are no breaking and critical changes. But the change will cause all users to logout from the system, since the algorithm for obtaining a secret token will be changed.
Type of change
Additional information
I injected logging in the
auth()
method and got the following results.Before changes:

After changes:

.jwt_secret
file were created manually vianano
.Checklist
ruff format frigate
)