You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@seata.apache.org by "28Hus (via GitHub)" <gi...@apache.org> on 2026/10/15 02:06:46 UTC
[PR] fix(console): require a deployment-specific JWT signing key [incubator-seata]
28Hus opened a new pull request, #8302:
URL: https://github.com/apache/incubator-seata/pull/8302
## Summary
Our research into authentication-token security identified the published JWT signing key discussed in #8225.
This PR enforces the documented requirement to replace that key before deployment. It complements Seata's network-isolation requirements and keeps the existing authentication flow unchanged.
## Changes
- Replace the fixed NamingServer key with `${SEATA_SECRET_KEY:}`.
- Reject missing or blank keys, invalid Base64, keys shorter than 32 decoded bytes, and the former public default during startup.
- Compare decoded bytes to reject equivalent Base64 representations of the former default.
- Remove the fixed key from the existing test configuration.
- Generate and inject an ephemeral key before Maven tests and native-binary verification in the relevant CI workflows.
No new test files or dependencies are added.
## Configuration
Generate a key once:
```bash
export SEATA_SECRET_KEY="$(openssl rand -base64 32)"
```
Store it securely and supply the same value across restarts and instances through deployment configuration or a secret manager. Do not regenerate it on every startup.
Deployments retaining the former default must replace it. Tokens signed with the former key will no longer verify. For local tests, export a temporary key before running the existing Maven test command; CI handles this automatically.
## Local Validation
- Scoped Spotless formatting and `git diff --check` passed.
- The modified class compiled with Java 17 compatibility using locally available dependencies.
- Seven invalid-key cases were rejected, including the former default and an equivalent Base64 representation.
- JWT signing, verification, and authentication extraction passed a local round-trip check.
- Lightweight Spring contexts loading the actual runtime and test YAML files both accepted the injected random key and rejected missing keys during `@PostConstruct`.
- Modified workflow YAML and relevant shell syntax checks passed.
- The native-verification key-generation step was executed locally: separate executions generated distinct 32-byte keys and correctly wrote the environment-file entry.
Full application startup, the complete Maven test suite, native-image builds, and GitHub Actions execution have not been verified.
## Usability Trade-off
Generating a random key automatically when configuration is absent could preserve zero-configuration startup. However, a process-local key would invalidate existing tokens after a restart and prevent independent instances from verifying each other's tokens.
This minimal change therefore requires explicit configuration. Installation-time generation and secure persistence could improve usability in a future change, with appropriate handling for restarts and multi-instance deployments.
Related: #8225.
This contribution is part of my ongoing research into authentication security. I'm glad to contribute to improving Apache Seata's security and welcome your feedback.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] fix(console): require a deployment-specific JWT signing key [incubator-seata]
Posted by "funky-eyes (via GitHub)" <gi...@apache.org>.
funky-eyes commented on code in PR #8302:
URL: https://github.com/apache/incubator-seata/pull/8302#discussion_r4321201672
##########
.github/workflows/test.yml:
##########
@@ -119,6 +120,7 @@ jobs:
- name: "Test with Maven on '${{ matrix.os }}' OS"
if: ${{ ! startsWith(matrix.os, 'windows') }}
run: |
+ export SEATA_SECRET_KEY="$(openssl rand -base64 32)"
Review Comment:
I don't think these operations should be performed in a script. I suggest using the existing automatic password generation logic in the console as a reference.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] fix(console): require a deployment-specific JWT signing key [incubator-seata]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #8302:
URL: https://github.com/apache/incubator-seata/pull/8302#issuecomment-6186619340
## [Codecov](https://app.codecov.io/gh/apache/incubator-seata/pull/8302?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `41.66667%` with `7 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 79.91%. Comparing base ([`8a31b1f`](https://app.codecov.io/gh/apache/incubator-seata/commit/8a31b1f41da325f5b498d3fa2853221620388d35?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`ad3599c`](https://app.codecov.io/gh/apache/incubator-seata/commit/ad3599c315270ef191fafd153ccb921f501ae0ec?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
| [Files with missing lines](https://app.codecov.io/gh/apache/incubator-seata/pull/8302?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [.../org/apache/seata/console/utils/JwtTokenUtils.java](https://app.codecov.io/gh/apache/incubator-seata/pull/8302?src=pr&el=tree&filepath=console%2Fsrc%2Fmain%2Fjava%2Forg%2Fapache%2Fseata%2Fconsole%2Futils%2FJwtTokenUtils.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29uc29sZS9zcmMvbWFpbi9qYXZhL29yZy9hcGFjaGUvc2VhdGEvY29uc29sZS91dGlscy9Kd3RUb2tlblV0aWxzLmphdmE=) | 41.66% | [4 Missing and 3 partials :warning: ](https://app.codecov.io/gh/apache/incubator-seata/pull/8302?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## 2.x #8302 +/- ##
============================================
- Coverage 79.91% 79.91% -0.01%
+ Complexity 1165 1162 -3
============================================
Files 1400 1400
Lines 53011 53023 +12
Branches 6349 6352 +3
============================================
+ Hits 42365 42373 +8
- Misses 7695 7697 +2
- Partials 2951 2953 +2
```
| [Files with missing lines](https://app.codecov.io/gh/apache/incubator-seata/pull/8302?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [.../org/apache/seata/console/utils/JwtTokenUtils.java](https://app.codecov.io/gh/apache/incubator-seata/pull/8302?src=pr&el=tree&filepath=console%2Fsrc%2Fmain%2Fjava%2Forg%2Fapache%2Fseata%2Fconsole%2Futils%2FJwtTokenUtils.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29uc29sZS9zcmMvbWFpbi9qYXZhL29yZy9hcGFjaGUvc2VhdGEvY29uc29sZS91dGlscy9Kd3RUb2tlblV0aWxzLmphdmE=) | `85.41% <41.66%> (-14.59%)` | :arrow_down: |
... and [12 files with indirect coverage changes](https://app.codecov.io/gh/apache/incubator-seata/pull/8302/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
[](https://app.codecov.io/gh/apache/incubator-seata/pull/8302?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] fix(console): require a deployment-specific JWT signing key [incubator-seata]
Posted by "28Hus (via GitHub)" <gi...@apache.org>.
28Hus commented on PR #8302:
URL: https://github.com/apache/incubator-seata/pull/8302#issuecomment-6309258455
@funky-eyes
Thanks for reviewing the update. The Java 21 job failed while starting the server for the unchanged `BranchSessionExecuteTest`, with `Address already in use`. This appears unrelated to the JWT changes; the Java 8, 17, and 25 jobs passed. Could you please rerun the failed Java 21 job when convenient? Thank you for your help!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] fix(console): require a deployment-specific JWT signing key [incubator-seata]
Posted by "28Hus (via GitHub)" <gi...@apache.org>.
28Hus commented on code in PR #8302:
URL: https://github.com/apache/incubator-seata/pull/8302#discussion_r4322348629
##########
.github/workflows/test.yml:
##########
@@ -119,6 +120,7 @@ jobs:
- name: "Test with Maven on '${{ matrix.os }}' OS"
if: ${{ ! startsWith(matrix.os, 'windows') }}
run: |
+ export SEATA_SECRET_KEY="$(openssl rand -base64 32)"
Review Comment:
Thanks for the suggestion. I’ve moved random key generation into Java initialization and removed the generation commands from the workflows.
When no key is configured, a random 32-byte key is generated once and kept in memory without being logged. Restarts invalidate existing tokens; deployments needing persistence or multiple instances can configure SEATA_SECRET_KEY. Invalid configured keys are still rejected.
The six focused JWT tests, three Spring lifecycle checks, and formatting checks passed. Please take another look when convenient. Thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org