fix(gateway): set jwksUrl so the dispatcher builds a validator #68

2026-10-27T08:17:17Z

poimen commented

2026-10-27 08:17:17 +00:00

main.go:144 builds the adapter validator only when auth.enabled AND auth.jwksUrl are set. jwksUrl was intentionally unset, so jwtValidator stayed nil and every adapter request passed with a warning. This makes auth.required real.

poimen added 1 commit 2026-10-27 08:17:19 +00:00

fix(gateway): set jwksUrl so the dispatcher builds a validator

CI / CI (pull_request) Successful in 2m9s

Details

CI / CI (push) Successful in 3m29s

Details

ba8800d565

cmd/gateway/main.go:144 constructs the adapter validator only when both
cfg.Auth.Enabled and cfg.Auth.JWKSURL are set. The config left jwksUrl unset on
purpose, so jwtValidator stayed nil and every adapter request passed with one
warning line:

  auth required but jwtValidator nil; request unauthenticated

That made auth.required cosmetic: sqs, workflow, memory, s3 and iam all answered
unauthenticated calls. Set the JWKS URL to the ZITADEL key endpoint.

rock merged commit ba8800d565 into main

2026-10-27 08:17:27 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#68