auth: silent JWT degradation when Dex is unreachable #6

New Issue

mathias · 2026-05-14T08:44:09Z

mathias commented

2026-05-14 08:44:09 +00:00

When Dex is unreachable at startup, NewJWTValidator returns nil, nil and emits a warning. All subsequent JWT validation calls silently return false, falling through to the static token check. The resulting 401 gives the caller no indication of whether their JWT was invalid or Dex was unavailable.

Files:

cmd/gitea-mcp/main.go:30-33 — silent nil return on Dex failure
internal/auth/jwt.go:61-63 — Validate returns false when validator is nil

Suggestions:

Expose a GET /healthz that reports JWT validator status (enabled/disabled/last-error)
Log Dex availability state on each auth attempt when the validator is nil so ops can correlate with Dex outage windows
Consider returning a 503 with WWW-Authenticate: Bearer error="temporarily_unavailable" when Dex is known-down vs a generic 401

When Dex is unreachable at startup, `NewJWTValidator` returns `nil, nil` and emits a warning. All subsequent JWT validation calls silently return `false`, falling through to the static token check. The resulting 401 gives the caller no indication of whether their JWT was invalid or Dex was unavailable. **Files:** - `cmd/gitea-mcp/main.go:30-33` — silent nil return on Dex failure - `internal/auth/jwt.go:61-63` — Validate returns false when validator is nil **Suggestions:** - Expose a `GET /healthz` that reports JWT validator status (enabled/disabled/last-error) - Log Dex availability state on each auth attempt when the validator is nil so ops can correlate with Dex outage windows - Consider returning a `503` with `WWW-Authenticate: Bearer error="temporarily_unavailable"` when Dex is known-down vs a generic 401

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mathias/gitea-mcp#6