Repository navigation
feat: log the auth method on JWT rejection - #1252
Merged
Merged
Conversation
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues were identified for the change distinguishing HMAC and JWKS rejection warnings.
No open issues 🎉
What changed in this PR
Adds the rejecting verifier to JWT rejection warnings, making HMAC and JWKS failures distinguishable in logs without changing the telemetry method tag.
Changes:
- Appends the authentication method, such as
(hmac)or(jwks), to rejection warnings. - Adds assertions for both method suffixes in existing rejection tests.
| File | Description |
|---|---|
test/supavisor/jwt_test.exs |
Asserts HMAC and JWKS method suffixes in rejection logs. |
lib/supavisor/jwt.ex |
Includes the authentication method in rejection warnings. |
Review effort: Balanced
mentels
enabled auto-merge (squash)
October 28, 2026 11:48
v0idpwn
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
check_auth: rejected ...warning now ends with the verifier that rejected the token, e.g.(hmac)or(jwks), so shared-secret and JWKS (AWS STS) failures can be told apart in the logs.methodtag on the[:supavisor, :jwt_auth, :rejected]metric is unchanged.Test plan
jwt_test.exsasserts the suffix for an HMAC rejection and a JWKS rejection.🤖 Generated with Claude Code