1559471 - Provide a JWT private key to web-server

Status: RESOLVED FIXED

(Taskcluster :: Services, defect)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

In my deployment:

{"EnvVersion":"2.0","Fields":{"code":"ERR_ASSERTION","expected":true,"generatedMessage":false,"message":"jwt.generate requires a privateKey","name":"AssertionError [ERR_ASSERTION]","operator":"==","stack":"AssertionError [ERR_ASSERTION]: jwt.generate requires a privateKey\n    at Object.generate (/app/services/web-server/src/utils/jwt.js:12:5)\n    at Strategy.passport.use.Strategy [as _verify] (/app/services/web-server/src/login/strategies/github.js:89:77)\n    at process._tickCallback (internal/process/next_tick.js:68:7)","v":1},"Hostname":"taskcluster-web-server-web-7c84b759db-tcrps","Logger":"taskcluster.web-server","Pid":1,"Severity":3,"Timestamp":1560538493056000000,"Type":"monitor.error","message":"AssertionError [ERR_ASSERTION]: jwt.generate requires a privateKey\n    at Object.generate (/app/services/web-server/src/utils/jwt.js:12:5)\n    at Strategy.passport.use.Strategy [as _verify] (/app/services/web-server/src/login/strategies/github.js:89:77)\n    at process._tickCallback (internal/process/next_tick.js:68:7)","serviceContext":{"service":"web-server","version":"v14.1.0"},"severity":"ERROR"}

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

This is currently using RSA256 which uses asymmetric keys for the signature. Since the same process is both generating and verifying the JWT, we can probably use something symmetric like HS256. An additional advantage would be that it's much easier to generate a signing key for such a thing.

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/taskcluster/taskcluster/pull/872