Local GoTrue signs JWTs with HS256, but the JWKS migration (#75) only supports RS256. The /.well-known/jwks.json endpoint returns an empty key set locally, causing 500 errors on all authenticated endpoints.
Added HS256 fallback: _verify_jwt tries JWKS/RS256 first, then falls back to verifying with SUPABASE_JWT_SECRET (HS256). Production (Supabase Cloud) is unaffected.
Added supabase_jwt_secret config setting, wired it through docker-compose.yml and .env.example files.
Test plan
docker compose up and verify authenticated requests (e.g. POST /api/v1/runs) no longer return 500
Verify JWT verification still works in production with JWKS/RS256
## Summary
- Local GoTrue signs JWTs with HS256, but the JWKS migration (#75) only supports RS256. The `/.well-known/jwks.json` endpoint returns an empty key set locally, causing 500 errors on all authenticated endpoints.
- Added HS256 fallback: `_verify_jwt` tries JWKS/RS256 first, then falls back to verifying with `SUPABASE_JWT_SECRET` (HS256). Production (Supabase Cloud) is unaffected.
- Added `supabase_jwt_secret` config setting, wired it through `docker-compose.yml` and `.env.example` files.
## Test plan
- [ ] `docker compose up` and verify authenticated requests (e.g. `POST /api/v1/runs`) no longer return 500
- [ ] Verify JWT verification still works in production with JWKS/RS256
Local GoTrue signs JWTs with HS256, but the JWKS endpoint returns an
empty key set since there are no RSA keys. Fall back to HS256 shared
secret verification when JWKS fails, using SUPABASE_JWT_SECRET.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
TheFurya
merged commit d98b0da410 into develop2026-03-22 09:41:43 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
/.well-known/jwks.jsonendpoint returns an empty key set locally, causing 500 errors on all authenticated endpoints._verify_jwttries JWKS/RS256 first, then falls back to verifying withSUPABASE_JWT_SECRET(HS256). Production (Supabase Cloud) is unaffected.supabase_jwt_secretconfig setting, wired it throughdocker-compose.ymland.env.examplefiles.Test plan
docker compose upand verify authenticated requests (e.g.POST /api/v1/runs) no longer return 500