abstrask opened a new pull request, #9230:
URL: https://github.com/apache/devlake/pull/9230
### Summary
`GithubAppKey.CreateJwt` set `iat = now` and `exp = now + 600`. GitHub
rejects a JWT whose `exp` is more than 10 minutes in the future, so a host
clock even 1s ahead of GitHub's made installation token requests fail with 401
("'Expiration time' claim ('exp') is too far in the future").
This follows GitHub's recommendation: `iat` is backdated by 60s and `exp` is
set to `now + 540`, so the token lifetime stays at 10 minutes. Added a unit
test that checks both bounds.
GitHub docs:
https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app
### Does this close any open issues?
Part of #9220 (the JWT part only; the silent cron failure and the 401
passthrough are left for separate PRs).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
