The proxy derived per-user GraphQL cache keys from JWT claims without
verifying the token signature (CWE-345). A remote attacker could forge a
token that carried a victim's claim value and read the victim's cached
response.
This change adds opt-in signature verification behind JWT_VERIFY_SIGNATURE.
The flag defaults to false, so an upgrade without a config change keeps the
previous delegate-to-upstream behavior byte for byte.
When verification is on, the operator must set exactly one key source:
JWT_SECRET, JWT_PUBLIC_KEY, or JWT_JWKS_URL. The verifier pins the accepted
algorithms to the key family through WithValidMethods and a type-switched
keyfunc, and it refuses alg=none. This closes the algorithm-confusion class
of attack. A present but invalid token now returns 401. A missing
Authorization header stays anonymous.
Startup fails loudly when verification is on and the key source is absent or
unreadable, so the proxy can never boot half-configured.
Three bugs fixed:
1. **Test suite timeout** — The main-package test suite timed out at 120s
because each failing request triggered 7 retries with exponential
backoff (500ms base → 10s max ≈ 25.5s per request). Tests that trip
the circuit breaker (3 requests × 25.5s = 76.5s) plus
TestStartHTTPProxy_ErrorHandlerConfigured (another 25.5s) pushed
cumulative time past the limit.
Fix: add `Client.RetryBaseDelayMs` / `Client.RetryMaxDelayMs` config
fields (env: CLIENT_RETRY_BASE_DELAY_MS / CLIENT_RETRY_MAX_DELAY_MS,
defaults 500ms / 10000ms). Tests override these to 10ms so retry
exhaustion completes in milliseconds. Full suite now runs in ~35s.
2. **effectiveCircuitBackoff float overflow** — On amd64, converting
`+Inf` (float64) to `time.Duration` (int64) saturates to MinInt64,
not MaxInt64. The existing "< base" guard then returned `base` instead
of `maxSaneCircuitBackoff`, breaking the sanity ceiling for an uncapped
config with a high trip count. Fix: detect `math.IsInf / math.IsNaN`
before the cast and return the ceiling directly.
3. **TestStartHTTPProxy_ErrorHandlerConfigured** — standalone top-level
test calling parseConfig() directly, bypassing the TestSuite override.
Now sets and restores RetryBaseDelayMs/RetryMaxDelayMs explicitly.
Co-authored-by: lukaszraczylo <[email protected]>
Invalid numeric environment values parsed to zero, an invalid prefixed
value fell through to a stale unprefixed value, and the prefixed boolean
parser rejected on and yes that the unprefixed parser accepted. A
non-positive cache TTL or retry-budget rate could crash or disable a
subsystem.
Parsing now warns and uses the coded default for an invalid value,
prefixed and unprefixed booleans accept the same tokens, and the cache
TTL and retry rate are clamped. A dead per-endpoint circuit config was
removed and a BIND_ADDRESS option was added, defaulting to the current
all-interfaces bind. The pprof server now stops on shutdown.
* This change introduces ability to set additional endpoint leading to the
instance of the graphql server connected to the read only database.
If regular query is detected and endpoint for `HOST_GRAPHQL_READONLY` value is set,
the query will be proxied to it. Mutations and non-graphql will be sent
to the `HOST_GRAPHQL` endpoint.
lukaszraczylo
