Need help with PGRST301 JWSError JWSInvalidSignature

[Nick-Nal]

Greetings

For some reason I'm having troubles with authentication, show me my errors, please

Technical setup:

• PostgREST 11.1.0
• PostgreSQL 15.3
• Python 3.11.4 / Flask 2.3.2
• Everything is in Docker 4.20.0, accessible from inside of the container with curl 7.74 and externally from Windows with curl 8.0.1

Setup for anon role, authenticator and technical schema 'postgrest' (for JWT generation and storage, accessed only by superuser):
Executed by superuser in DB "db_name"

drop schema public cascade;

create role "postgrest_anon" noinherit nocreatedb nosuperuser nologin;
create role "postgrest_authenticator" noinherit nocreatedb nosuperuser login password 'postgrest_authenticator_password';

revoke all on schema "postgrest" from public;
revoke all on all tables in schema "postgrest" from public;
revoke all on all functions in schema "postgrest" from public;
grant "postgrest_anon" to "postgrest_authenticator";

alter default privileges for role "postgrest_anon" grant all on schemas to "postgrest_authenticator";
alter role "postgrest_authenticator" in database "db_name" set search_path = "postgrest", test;
alter role "postgrest_anon" in database "db_name" set search_path = "postgrest", test;

PGRST_DB_URI: postgres://postgrest_authenticator:postgrest_authenticator_password@postgres-db:5432/db_name
PGRST_DB_ANON_ROLE: postgrest_anon
PGRST_JWT_SECRET: WHPPJMDJZCYRGBJTNIWASUXFEUVJQWAII

No problems there, anonymous requests works good if explicitly grant access on object to anon / public user.

==============================================================

Setup for user role (there could be many schemas for one user and many users):
Executed by superuser in DB "db_name"

create role "nikolai.nalbantov" noinherit nocreatedb nosuperuser login password 'user_password'

create schema if not exists "nikolai_nalbantov_branch_1_schema"

create table "nikolai_nalbantov_branch_1_schema".v_editor_tables (mt_json json, mt_table_name text, mt_table_schema text);

revoke all on schema "nikolai_nalbantov_branch_1_schema" from public;

alter schema "nikolai_nalbantov_branch_1_schema" owner to "nikolai.nalbantov";

grant all on all tables in schema "nikolai_nalbantov_branch_1_schema" to "nikolai.nalbantov";
grant all on all sequences in schema "nikolai_nalbantov_branch_1_schema" to "nikolai.nalbantov";
grant all on all routines in schema "nikolai_nalbantov_branch_1_schema" to "nikolai.nalbantov";

alter default privileges for role "nikolai.nalbantov" grant all on schemas to "postgrest_authenticator";
alter default privileges in schema "nikolai_nalbantov_branch_1_schema" for role "nikolai.nalbantov" grant select, insert, update, delete on tables to "postgrest_authenticator";
alter default privileges in schema "nikolai_nalbantov_branch_1_schema" for role "nikolai.nalbantov" grant all on sequences to "postgrest_authenticator";
alter default privileges in schema "nikolai_nalbantov_branch_1_schema" for role "nikolai.nalbantov" grant all on routines to "postgrest_authenticator";
alter default privileges in schema "nikolai_nalbantov_branch_1_schema" for role "nikolai.nalbantov" grant all on types to "postgrest_authenticator";

grant "nikolai.nalbantov" to "postgrest_authenticator";

alter role "postgrest_authenticator" in database "db_name" set pgrst.db_schemas = 'nikolai_nalbantov_branch_1_schema, ...';

notify pgrst, 'reload config'
notify pgrst, 'reload schema'

I've generated two JWT tokens with secret 'WHPPJMDJZCYRGBJTNIWASUXFEUVJQWAII' (33 symbols), algorithm HS256

One for role postgrest_authenticator (expiration set to year 2055):
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoicG9zdGdyZXN0X2F1dGhlbnRpY2F0b3IiLCJleHAiOjI2ODY3MTk4NjJ9.dNbRO4G69dDQw11p793bJt27l0P9eqjK8Hp7d8rSpUk

One for user nikolai.nalbantov (expiration = +4 hours from now()):
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoibmlrb2xhaS5uYWxiYW50b3YiLCJleHAiOjE2ODY3MzQzMjR9.vZBZkh1066n3ICZKt25n-ungO9tnyh_u8Lct8rNYFD8

Both tokens are valid (according to jwt.io) and correctly delivered in-app to the request

And here's the problem - any attempt of authorized request with JWT token fails like that:

curl -X GET "http://127.0.0.1:3000/v_editor_tables"
 -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoibmlrb2xhaS5uYWxiYW50b3YiLCJleHAiOjE2ODY3MzQzMjR9.vZBZkh1066n3ICZKt25n-ungO9tnyh_u8Lct8rNYFD8" 
 -H "Prefer: return=representation"
 -H "Content-Type: application/json"
 -H "Accept-Profile: nikolai_nalbantov_branch_1_schema"

{"code":"PGRST301","details":null,"hint":null,"message":"JWSError JWSInvalidSignature"}

Same result from app, from curl inside Docker, for curl outside Docker (example above).
Same result with JWT token for postgrest_authenticator as well

--

Please, what I'm doing wrong?

[Nick-Nal]

Is it possible that JWT secret somehow dropped to None after config reload?

And if yes, how to correctly update it in-database?
Documentation is ambigous on that, mentions both pgrst.db_jwt_secret and pgrst.jwt_secret
https://postgrest.org/en/stable/references/configuration.html

UPD: just used

alter role "postgrest_authenticator" in database "db_name" set pgrst.jwt_secret = 'WHPPJMDJZCYRGBJTNIWASUXFEUVJQWAII';

notify pgrst, 'reload config'

Same result, PGRST301

[laurenceisla]

Oh, that is an error in the docs. The correct one is pgrst.jwt_secret.

[Nick-Nal]

Forgot to mention

Unsuccesfull attempts looks like this in log:

postgrest-api           | 172.19.0.4 - - [14/Jun/2023:04:06:14 -0300] "POST /meta_env HTTP/1.1" 401 - "" "python-requests/2.31.0"
postgrest-api           | 172.19.0.1 - - [14/Jun/2023:04:18:17 -0300] "GET /v_editor_tables HTTP/1.1" 401 - "" "curl/8.0.1"

For some reason there's no user identificator

Succesfull attempt from postgrest_anon have user ID (code 400 is unrelated here)

postgrest-api           | 172.19.0.1 - postgrest_anon [14/Jun/2023:04:19:04 -0300] "POST /v_editor_tables HTTP/1.1" 400 - "" "curl/8.0.1"

[laurenceisla]

I get Signature Error when verifying the tokens in https://jwt.io. The same secret gives me different tokens, so these ones should work.

For postgrest_authenticator:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoicG9zdGdyZXN0X2F1dGhlbnRpY2F0b3IiLCJleHAiOjI2ODY3MTk4NjJ9.6pwqDgum4zi6AAm1ZE14Gerla62jFahda5RxewDQm38

For nikolai.nalbantov (this should give a "JWT expired" error):

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoibmlrb2xhaS5uYWxiYW50b3YiLCJleHAiOjE2ODY3MzQzMjR9.JL0VjzaH_N5310cWn3Pa8xr4_SUWxUtb4sswxdTLTl4

I got curious and verified that using 'WHPPJMDJZCYRGBJTNIWASUXFEUVJQWAII' (including the ') as secret worked for your examples. Removing the ' when building your JWT should fix the issue.

[Nick-Nal]

Oh man, that validation on jwt.io is quite misleading, even changes input token without notice

Thanks, will look into source of these quotes