Skip to content

Conversation

@jonathan-r-thorpe
Copy link
Contributor

After doing some controller testing of nmos-js using authorization the following issues were identified:

  • The Auth server causes cross origin errors in browsers when using authorization code flow authentication
  • The mock Auth required the use of private key JWT - however, this is optional
  • The mock Auth required scopes to be supplied on token refresh - however, this is optional
  • The mock Node was not authenticating its API
  • Both mock Registry and Node had poor responsiveness when using authentication mainly due to the token evaluation process being expensive

The following fixes were introduced:

  • Wrap the mock Auth server in a CORS wrapper
  • Make use of private key JWT optional
  • Cache scopes on authentication to use on token refresh if scopes not supplied.
  • Factor the authentication checking into a utility function
  • Add authentication to the mock Node
  • Introduce auth caching on Registry and Node so decoding of tokens only happens once for each scope

@jonathan-r-thorpe jonathan-r-thorpe marked this pull request as ready for review August 8, 2025 12:14
@jonathan-r-thorpe
Copy link
Contributor Author

Checked for regressions against nmos-cpp on Windows/Ubuntu with authorization enabled/disabled.

@jonathan-r-thorpe jonathan-r-thorpe marked this pull request as draft August 8, 2025 12:23
Copy link
Contributor

@lo-simon lo-simon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a couple of minor suggestions, rest LGTM.

@jonathan-r-thorpe jonathan-r-thorpe marked this pull request as ready for review August 8, 2025 15:35
@peterbrightwell peterbrightwell changed the title Address authorization issues with mock resources Fix authorization issues with mock resources Aug 27, 2025
Copy link
Contributor

@cristian-recoseanu cristian-recoseanu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems reasonable, however, I do not have an environment where I can test this change.

@jonathan-r-thorpe jonathan-r-thorpe merged commit 9c6a2f8 into master Oct 15, 2025
1 check passed
@jonathan-r-thorpe jonathan-r-thorpe deleted the fix-mock-auth branch October 15, 2025 09:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants