Page MenuHomePhabricator
Create Task
Maniphest T440060

REST Gateway: use the sxp field for token expiry
Open, In Progress, Needs TriagePublic
Actions

Description

MediaWiki doesn't set the standard exp claim on the tokens in the sessionJwt cookie. Envoy will consider these tokens to be valid forever. We'll have to check the custom sxp claim manually to check if a token is expired. Expired tokens form cookies should be ignored, while expired tokens from headers should be rejected.

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
REST Gateway: add trust expiry for rlc claims.Daniel Kinzleroperations/deployment-chartsmaster+270 -21
Customize query in gerrit

Event Timeline

daniel created this task.Fri, Oct 2, 9:19 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFri, Oct 2, 9:19 PM
KineticPelagic moved this task from Incoming (Needs Triage) to To Estimate on the MediaWiki-API-Platform-Team board.Sat, Oct 3, 6:06 AM
KineticPelagic subscribed.

I am moving this task as part of my Clinic Duty rotation.

Tgr added a comment.Sun, Oct 4, 8:18 AM

Another approach would be to ignore all tokens where the iat (issued at) field is older than some given threshold. That's robust against accidental minting of tokens with no / far future expiry.

Blake moved this task from Inbox to Radar (Awareness) on the ServiceOps board.Thu, Oct 8, 2:07 PM
BPirkle updated the task description. (Show Details)Thu, Oct 8, 4:19 PM
KineticPelagic moved this task from To Estimate to To Refine on the MediaWiki-API-Platform-Team board.Thu, Oct 8, 4:23 PM
gerritbot added a comment.Fri, Oct 9, 1:11 PM

Change #1353970 had a related patch set uploaded (by Daniel Kinzler; author: Daniel Kinzler):

[operations/deployment-charts@master] REST Gateway: add trust expiry for rlc claims.

https://gerrit.wikimedia.org/r/1353970

gerritbot added a project: Patch-For-Review.Fri, Oct 9, 1:11 PM
daniel changed the task status from Open to In Progress.Fri, Oct 9, 2:44 PM
daniel claimed this task.
daniel edited projects, added: MediaWiki-API-Platform-Team (MediaWiki-Interfaces-Sprints); removed: MediaWiki-API-Platform-Team.
daniel moved this task from Committed to Code Review on the MediaWiki-API-Platform-Team (MediaWiki-Interfaces-Sprints) board.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits