NgTech-LTD/gns3-server
2
0
Fork 0
mirror of https://github.com/GNS3/gns3-server.git synced 2026-08-27 12:30:13 +03:00
Code Issues Packages Projects Releases Wiki Activity

mcp: don't run API keys through JWT validation

Browse Source 
_resolve_token tried the JWT path before checking for the gns3_ prefix,
so every API-key connection logged a spurious "JWT rejected" ERROR from
get_token_data. Check the prefix first, and downgrade the JWT-rejected
log to WARNING — a rejected token is a client problem, not a server one.
This commit is contained in:
YueGuobin 2026-08-19 14:54:34 +08:00
parent 200ccf0dfe
commit c3145a9f65
No known key found for this signature in database
2 changed files with 12 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
gns3server/api/routes/mcp/__init__.py
View File

@ -213,14 +213,16 @@ async def _resolve_token(token: str) -> str | None:
Returns None if the token is invalid.
"""
# Try JWT first
try:
token_data = auth_service.get_token_data(token)
_jwt_username_var.set(token_data.username)
_jwt_token_version_var.set(token_data.token_version)
return token
except Exception:
pass
# API keys (gns3_...) are never valid JWTs — skip the JWT attempt for them
# so it doesn't log a spurious "JWT rejected" line on every API-key connection.
if not token.startswith("gns3_"):
try:
token_data = auth_service.get_token_data(token)
_jwt_username_var.set(token_data.username)
_jwt_token_version_var.set(token_data.token_version)
return token
except Exception:
pass
# Try API key — format: gns3_<api_key_id>_<random_secret> → O(1) lookup
if token.startswith("gns3_") and _app is not None:

4
gns3server/services/authentication.py
View File

@ -115,10 +115,10 @@ class AuthService:
token_use: str = payload.claims.get("type", "access")
token_data = TokenData(username=username, token_version=token_version, token_use=token_use)
except BadSignatureError as e:
log.error("JWT rejected: bad signature (header alg: '%s', error: %s)", _extract_alg(token), e)
log.warning("JWT rejected: bad signature (header alg: '%s', error: %s)", _extract_alg(token), e)
raise auth_error("Invalid token signature")
except (JoseError, ValidationError, ValueError) as e:
log.error("JWT rejected: %s: %s (header alg: '%s')", type(e).__name__, e, _extract_alg(token))
log.warning("JWT rejected: %s: %s (header alg: '%s')", type(e).__name__, e, _extract_alg(token))
raise auth_error(f"Invalid token ({type(e).__name__})")
return token_data