Skip to content

Trim secret before signing JWT tokens

Igor Drozdov requested to merge id-fix-jwt-tokens into master

Currently, we send plain secret to Gitlab Rails in order to authenticate gitlab-shell requests, but we want to use JWT tokens instead: https://gitlab.com/gitlab-org/gitlab/-/issues/325167. However, Rails part removes trailing new lines both from the input (sent gitlab-shell header) and the secret that it reads from the config.

I thought that we could workaround it by reading plain values for the secret from the file. But it's unreliable since shared secrets for Rails, Gitlab Shell and Gitaly can be different files.

With this change, we don't rely on the secret to either contain a newline or not contain it.

Related issues:

Merge request reports

Loading