Increase length of JWT secret to avoid errors in lcobucci/jwt ^4.2

[silverbackdan]

Q	A
License	MIT
Doc issue/PR	n/a

I'm not sure if I should have added this in a new version or included previous config directories.

But the length of the JWT secret needs to be longer by default
See: symfony/mercure#89
See: https://github.com/symfony/symfony-docs/pull/17259/files
See: symfony/mercure#89
See: https://github.com/lcobucci/jwt/releases/tag/4.2.0

[github-actions]

Thanks for the PR 😍

How to test these changes in your application

1. Define the SYMFONY_ENDPOINT environment variable:

   # On Unix-like (BSD, Linux and macOS)
   export SYMFONY_ENDPOINT=https://raw.githubusercontent.com/symfony/recipes/flex/pull-1124/index.json
   # On Windows
   SET SYMFONY_ENDPOINT=https://raw.githubusercontent.com/symfony/recipes/flex/pull-1124/index.json

2. Install the package(s) related to this recipe:

   composer req 'symfony/flex:^1.16'
   composer req 'symfony/mercure-bundle:^0.3'

3. Don't forget to unset the SYMFONY_ENDPOINT environment variable when done:

   # On Unix-like (BSD, Linux and macOS)
   unset SYMFONY_ENDPOINT
   # On Windows
   SET SYMFONY_ENDPOINT=

Diff between recipe versions

In order to help with the review stage, I'm in charge of computing the diff between the various versions of patched recipes.
I'm going keep this comment up to date with any updates of the attached patch.

symfony/mercure-bundle

0.1 vs 0.2

diff --git a/symfony/mercure-bundle/0.1/config/packages/mercure.yaml b/symfony/mercure-bundle/0.2/config/packages/mercure.yaml
index d1947d1..17aaa0c 100644
--- a/symfony/mercure-bundle/0.1/config/packages/mercure.yaml
+++ b/symfony/mercure-bundle/0.2/config/packages/mercure.yaml
@@ -1,4 +1,5 @@
 mercure:
+    enable_profiler: '%kernel.debug%'
     hubs:
         default:
             url: '%env(MERCURE_PUBLISH_URL)%'

0.2 vs 0.3

diff --git a/symfony/mercure-bundle/0.2/config/packages/mercure.yaml b/symfony/mercure-bundle/0.3/config/packages/mercure.yaml
index 17aaa0c..f2a7395 100644
--- a/symfony/mercure-bundle/0.2/config/packages/mercure.yaml
+++ b/symfony/mercure-bundle/0.3/config/packages/mercure.yaml
@@ -1,6 +1,8 @@
 mercure:
-    enable_profiler: '%kernel.debug%'
     hubs:
         default:
-            url: '%env(MERCURE_PUBLISH_URL)%'
-            jwt: '%env(MERCURE_JWT_TOKEN)%'
+            url: '%env(MERCURE_URL)%'
+            public_url: '%env(MERCURE_PUBLIC_URL)%'
+            jwt:
+                secret: '%env(MERCURE_JWT_SECRET)%'
+                publish: '*'
diff --git a/symfony/mercure-bundle/0.2/manifest.json b/symfony/mercure-bundle/0.3/manifest.json
index ba8f74d..9df7a45 100644
--- a/symfony/mercure-bundle/0.2/manifest.json
+++ b/symfony/mercure-bundle/0.3/manifest.json
@@ -7,9 +7,41 @@
     },
     "env": {
         "#1": "See https://symfony.com/doc/current/mercure.html#configuration",
-        "MERCURE_PUBLISH_URL": "http://mercure/.well-known/mercure",
-        "#2": "The default token is signed with the secret key: !ChangeMe!",
-        "MERCURE_JWT_TOKEN": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJtZXJjdXJlIjp7InB1Ymxpc2giOltdfX0.Oo0yg7y4yMa1vr_bziltxuTCqb8JVHKxp-f_FwwOim0"
+        "#2": "The URL of the Mercure hub, used by the app to publish updates (can be a local URL)",
+        "MERCURE_URL": "https://example.com/.well-known/mercure",
+        "#3": "The public URL of the Mercure hub, used by the browser to connect",
+        "MERCURE_PUBLIC_URL": "https://example.com/.well-known/mercure",
+        "#4": "The secret used to sign the JWTs",
+        "MERCURE_JWT_SECRET": "!ChangeThisMercureHubJWTSecretKey!"
+    },
+    "docker-compose": {
+        "docker-compose.yml": {
+            "services": [
+                "mercure:",
+                "  image: dunglas/mercure",
+                "  restart: unless-stopped",
+                "  environment:",
+                "    SERVER_NAME: ':80'",
+                "    MERCURE_PUBLISHER_JWT_KEY: '!ChangeThisMercureHubJWTSecretKey!'",
+                "    MERCURE_SUBSCRIBER_JWT_KEY: '!ChangeThisMercureHubJWTSecretKey!'",
+                "    # Set the URL of your Symfony project (without trailing slash!) as value of the cors_origins directive",
+                "    MERCURE_EXTRA_DIRECTIVES: |",
+                "      cors_origins http://127.0.0.1:8000",
+                "  # Comment the following line to disable the development mode",
+                "  command: /usr/bin/caddy run -config /etc/caddy/Caddyfile.dev",
+                "  volumes:",
+                "    - mercure_data:/data",
+                "    - mercure_config:/config"
+            ],
+            "volumes": ["mercure_data:", "mercure_config:"]
+        },
+        "docker-compose.override.yml": {
+            "services": [
+                "mercure:",
+                "  ports:",
+                "    - \"80\""
+            ]
+        }
     },
     "aliases": ["mercure"]
 }

[chalasr]

I'm not sure if I should have added this in a new version or included previous config directories.

The version of the recipe must match an existing release of the target package, so given this is kind of a bugfix I think we should update all existing versions instead

[silverbackdan]

Sure, 0.1 and 0.2 define the actual token and it is signed with the short key - do I need to update those?

I'm not sure it'd cause an error because the exception is thrown when creating the JWT - Unsure if it's thrown when the JWT is already created

[silverbackdan]

Not quite sure what I need to change in the PR to avoid this error - sorry.

[chalasr]

The verification is handled by the mercure hub which is written in Go and uses github.com/golang-jwt/jwt/v4 which does not have such validation, so this is not an issue for now but might be one day. However mercure-bundle 0.1 and 0.2 didn't use lcobucci/jwt so I'd say we don't care at all about these versions.

[chalasr]

Not quite sure what I need to change in the PR to avoid this error - sorry.

No worry, I fear there's nothing we can do, all good for this PR. /cc @fabpot

[dunglas]

I just released a patch version of Mercure changing the default key used in dev mode: https://github.com/dunglas/mercure/releases/tag/v0.14.1

Can you please use the same value, so the recipe will work out of the box in dev mode.

[silverbackdan]

Sure thing @dunglas - updated the PR now.

[silverbackdan]

/cc @chalasr :)

[chalasr]

@silverbackdan The CI was complaining about the missing table in the PR description (including the MIT license). I took the liberty to add it myself, hope it's ok for you. The check is still red though, can you please try to force-push to retrigger it?

[silverbackdan]

Ah perfect - sorry I missed that.
@chalasr and @dunglas - nothing has changed in the PR just the commit message with the MIT licence in there too.
Just need re-approving. Thanks for bearing with.

[silverbackdan]

Merci