From 14383cfe8cd027d08c16aabba0a2d1f5dceef15a Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Fri, 13 Sep 2024 17:18:37 +0200 Subject: [PATCH] fix: race condition in system jwt signature check (#8618) --- internal/api/authz/system_token.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/internal/api/authz/system_token.go b/internal/api/authz/system_token.go index 9461bae3f..b8e360f8f 100644 --- a/internal/api/authz/system_token.go +++ b/internal/api/authz/system_token.go @@ -76,7 +76,7 @@ func (s *SystemTokenVerifierFromConfig) VerifySystemToken(ctx context.Context, t type systemJWTStorage struct { keys map[string]*SystemAPIUser - mutex sync.Mutex + mutex sync.RWMutex cachedKeys map[string]*rsa.PublicKey } @@ -98,7 +98,9 @@ func (s *SystemAPIUser) readKey() (*rsa.PublicKey, error) { } func (s *systemJWTStorage) GetKeyByIDAndClientID(_ context.Context, _, userID string) (*jose.JSONWebKey, error) { + s.mutex.RLock() cachedKey, ok := s.cachedKeys[userID] + s.mutex.RUnlock() if ok { return &jose.JSONWebKey{KeyID: userID, Key: cachedKey}, nil }