Fluksio/app
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Take the portal's JWKS from the tunnel and verify by kid

Browse Source 
The welcome frame's keys replace the set pinned at enrolment, but only
over wss:// or loopback, the rule enrolment applies to the portal
address. Portal tokens are verified against the key their kid names, so
the hub can publish a new key beside the old one. A welcome without keys,
from an older hub, leaves the pinned set alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WgBfkm4rCmtd1T4vHWjEPx
This commit is contained in:
stroblme
2026-10-15 10:31:40 +02:00
co-authored by Claude Opus 5.5
parent 3a7c10b8a9
commit ffa044724b
5 changed files with 83 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/interface/portal.md
+3 -2
View File
@@ -76,8 +76,9 @@ status reads **Removed at the portal** and the instance stops dialling. Connect
with a new code to restore remote access.
Local sign-in and flows continue after disconnecting. Portal requests follow
the instance's normal account permissions, and the instance verifies portal
tokens against the public signing key pinned during enrollment.
the instance's normal account permissions. The instance verifies portal tokens
against the portal's signing keys, which it pins during enrollment and takes
again from the portal each time it connects.
## Custom portals