Setting jwt_secret to JWKS with In-Database Configuration Fails

[robertsosinski]

Hello y'all,

So, I'm able to set jwt-secret (via PGRST_JWT_SECRET) to a JWKS when booting PostgREST 9 from docker without issue with the following:

-e PGRST_JWT_SECRET='{"keys":[{"alg":"RS256","e":"AQAB","kid":"...","kty":"RSA","n":"...","use":"sig"},{"alg":"RS256","e":"AQAB","kid":"...","kty":"RSA","n":"...","use":"sig"}]}'

However, when I try to instead set it with an In-Database Configuration, I get "message": "JWSError JWSInvalidSignature". I'm doing the following:

alter role auth set pgrst.jwt_secret = '{"keys":[{"alg":"RS256","e":"AQAB","kid":"...","kty":"RSA","n":"...","use":"sig"},{"alg":"RS256","e":"AQAB","kid":"...","kty":"RSA","n":"...","use":"sig"}]}';

I've tried a bunch of different ways of encoding it, such as escaped double-quoting and such, to no avail. Is there a specific way In-Database Configuration needs the JWKS to be formatted for it to work?

Thanks!

[wolfgangwalther]

You'll need to set those gucs both database specific and role specific.

You have:

alter role auth set pgrst.jwt_secret = [...]

You need:

alter role auth in database <your-database-name> set pgrst.jwt_secret =

I was about to point you to our docs.... only to realize that the docs are wrong! I'll create an issue to fix that.

[wolfgangwalther]

I guess I was a little bit too quick with that - we actually support both with IN DATABASE and without as I can tell from the tests and just confirmed again.

However I can remember I faced a similar problem a few weeks back and adding IN DATABASE was the solution.

Did this make a difference for your @robertsosinski?

[robertsosinski]

Hey again @wolfgangwalther thanks for looking into this.

So, I've confirmed a few things. PostgREST is picking up that there is a secret with both alter role auth set pgrst.jwt_secret and alter role auth in database postgrest_test set pgrst.jwt_secret. I can tell as without setting either I get the following error:

"message": "Server lacks JWT secret"

However, if I set one or the other, I get this error:

"message": "JWSError JWSInvalidSignature"

So it does look like both are supported as a place to store the secret, the problem comes when the secret is in JWKS format.

Happy to share the full command with a sandbox credential, they are well-known public keys anyway so no security concern, just to see if I'm doing something wrong. The command I used is this:

alter role auth in database postrest_test set pgrst.jwt_secret = '{"keys":[{"alg":"RS256","e":"AQAB","kid":"od8U2LDHgdOUUVJNWBI2tsA/pmOeYPI7fpE44PAfDcY=","kty":"RSA","n":"9ntVv8dlzumcLc0YJWGNfOz3bfJxxsKpLWywpfG-yBAFkKX-o7H6WTwbzu7paHdJGv3q1W04tks1sAjjm7Mo3AkyB04RwAN3gP5aWKrVXoE5uV3q2eWw2BKF0aWffAvbstpGfHbFcWjBs8V3Szkd4aVYr6QQwrr3jYGqhzqFW8HpTXxNJ6C1OUrLpX95LmNywz8dusUV2fl3vbb7N31MFe--fmcQElWFoyWpQnew95_wHNFy_gChvdbZTD-T8oNdMI9unyLWqYl1cZIJZn8GyaR3AXOCXsITl2tPIKu6V7HXG6YFPmS49Yh-EWUnoOsh99O1QsCxc9X8NrYKxwbDvQ","use":"sig"},{"alg":"RS256","e":"AQAB","kid":"I0nDuYIdKn26DPuLhlZ9kqADaWxTHHrogKqAmAglliU=","kty":"RSA","n":"8cEQV8fW5GAiYzS_isX24hcGKdGRgieeMYichBIHKyARZZfdRVSN46tOQxP2amFlGLLoXTa1JoVgIxNgjPznYaQsuaiQPh6t2Kx9bqClgE7b9R855CEuDUTaWnfCa6GNBbJKFd6eXdUyxXbBpe31foa3kzwD1T1C8UM2bIFXYYL71M-Ly1SrUWyFgd76P7qaRV4ttSJ-O3GGj_2VpysNeZ3OvnBWwVUEo4Q8tSWA2Np4VnjttoPEXCHrgoFRs9F-uwP_tinrQtefdrAdnPYCyGMxWTcbAUEJR17mwPlrWLhG_nNGYxPA3HZmFCtKVXsR3nNCOAjwG14UJs1Y2US2pQ","use":"sig"}]}';

Also, I tried by encoding the jwks as base64 and setting the PGRST_JWT_SECRET_IS_BASE64=true, and also with an in-database setting via alter role app_auth in database postquest set pgrst.jwt_secret_is_base64 = true;, however I get the following error:

postgrest: user error (Base64-encoded bytestring required to be padded)

And then PostgREST immediately crashes. What I'm doing with the base64 encoded commands looks like this;

alter role app_auth in database postquest set pgrst.jwt_secret_is_base64 = true;

alter role app_auth in database postquest set pgrst.jwt_secret = 'eyJrZXlzIjpbeyJhbGciOiJSUzI1NiIsImUiOiJBUUFCIiwia2lkIjoib2Q4VTJMREhnZE9VVVZKTldCSTJ0c0EvcG1PZVlQSTdmcEU0NFBBZkRjWT0iLCJrdHkiOiJSU0EiLCJuIjoiOW50VnY4ZGx6dW1jTGMwWUpXR05mT3ozYmZKeHhzS3BMV3l3cGZHLXlCQUZrS1gtbzdINldUd2J6dTdwYUhkSkd2M3ExVzA0dGtzMXNBamptN01vM0FreUIwNFJ3QU4zZ1A1YVdLclZYb0U1dVYzcTJlV3cyQktGMGFXZmZBdmJzdHBHZkhiRmNXakJzOFYzU3prZDRhVllyNlFRd3JyM2pZR3FoenFGVzhIcFRYeE5KNkMxT1VyTHBYOTVMbU55d3o4ZHVzVVYyZmwzdmJiN04zMU1GZS0tZm1jUUVsV0ZveVdwUW5ldzk1X3dITkZ5X2dDaHZkYlpURC1UOG9OZE1JOXVueUxXcVlsMWNaSUpabjhHeWFSM0FYT0NYc0lUbDJ0UElLdTZWN0hYRzZZRlBtUzQ5WWgtRVdVbm9Pc2g5OU8xUXNDeGM5WDhOcllLeHdiRHZRIiwidXNlIjoic2lnIn0seyJhbGciOiJSUzI1NiIsImUiOiJBUUFCIiwia2lkIjoiSTBuRHVZSWRLbjI2RFB1TGhsWjlrcUFEYVd4VEhIcm9nS3FBbUFnbGxpVT0iLCJrdHkiOiJSU0EiLCJuIjoiOGNFUVY4Zlc1R0FpWXpTX2lzWDI0aGNHS2RHUmdpZWVNWWljaEJJSEt5QVJaWmZkUlZTTjQ2dE9ReFAyYW1GbEdMTG9YVGExSm9WZ0l4TmdqUHpuWWFRc3VhaVFQaDZ0Mkt4OWJxQ2xnRTdiOVI4NTVDRXVEVVRhV25mQ2E2R05CYkpLRmQ2ZVhkVXl4WGJCcGUzMWZvYTNrendEMVQxQzhVTTJiSUZYWVlMNzFNLUx5MVNyVVd5RmdkNzZQN3FhUlY0dHRTSi1PM0dHal8yVnB5c05lWjNPdm5CV3dWVUVvNFE4dFNXQTJOcDRWbmp0dG9QRVhDSHJnb0ZSczlGLXV3UF90aW5yUXRlZmRyQWRuUFlDeUdNeFdUY2JBVUVKUjE3bXdQbHJXTGhHX25OR1l4UEEzSFptRkN0S1ZYc1Izbk5DT0Fqd0cxNFVKczFZMlVTMnBRIiwidXNlIjoic2lnIn1dfQ==';

When I set the parameters via Docker with PGRST_JWT_SECRET_IS_BASE64=true and PGRST_JWT_SECRET to the base64 encoded jwks, it works just fine though.

So, in a nutshell setting the JWKS as plaintext JSON in docker works; and setting the JWKS as base64 and PGRST_JWT_SECRET_IS_BASE64=true in docker works; however anyway I try to set it in the database fails. As plaintext in the database, I get "message": "JWSError JWSInvalidSignature", as base64 encoded I get the postgrest: user error (Base64-encoded bytestring required to be padded) error.

Thanks again for all the help!

[wolfgangwalther]

Thanks for the detailed report. I confirmed it's a bug and opened #2120.

[wolfgangwalther]

Fixed in #2121.

[robertsosinski]

Wow, thanks @wolfgangwalther that was super fast! Really appreciate yours and the teams work on PostgREST!

Have a great one!