#277: Revert - Make SECRET_SIGN_KEY environment auto-generated on backend start #294
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…p instead of environment variable | [#277]" The auto-generation of the secret signing key caused two major issues in production: 1. Multiple workers create separate instances of the app, each with a different signing key. This leads to validation failures when one instance tries to validate a JWT generated by another instance. 2. Render's production server sleeps after 5 minutes of inactivity, causing the signing key to be regenerated each time the app restarts, invalidating previously issued tokens. **Why this bug wasn't caught before production:** - Development mode uses hot reload, which disables workers. As a result, developers using ENV_VALUE=DEV only test with a single app instance. - The FastAPI test client also spawns a single app instance for testing, so the issue was not exposed during testing. This fix ensures that the JWT signing key is persisted across app instances and restarts. This reverts commit 2a8505c.
AntonioMrtz
deleted the
revert/277-make-secret_sign_key-environment-auto-generated-on-backend-start
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Reverts #278
The auto generation of the secret signing key causes 2 problems:
Why the bug wasn't caught before production deployment
Commit type
Revert
Issue
#277
Proposed Changes
Potential Impact
Screenshots
Additional Tasks
Assigned
@AntonioMrtz