yuqi1129 commented on issue #11571: URL: https://github.com/apache/gravitino/issues/11571#issuecomment-6435936408
@Santoshkumarpuppala Thanks for the detailed analysis and reproducer. Agreed—the current token-prefix approach cannot distinguish these JWT callers, and the tests miss that distinction. Would you be willing to include the fix in the scope of this issue, along with a regression test using tokens for different users that share the same JWT header? Please keep credentials out of the audit log and avoid treating unverified JWT claims as an authenticated identity. Feel free to propose the approach in your PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
