-
Notifications
You must be signed in to change notification settings - Fork 1
Open
Description
Bug Description
A vast number of secrets are being created in AWS Secrets Manager, far exceeding the expected count for a single application instance.
Suspected Culprit
In the DID generation and initialization logic within the did-endpoint plugin:
- Key Generation on Every Call: The
didgen()function incrates/web-plugins/did-endpoint/src/didgen.rsgenerates new cryptographic keys (Ed25519 and X25519) every time it is invoked. - Unreliable Validation Trigger: The plugin's
mount()function incrates/web-plugins/did-endpoint/src/plugin.rscallsdidgen()ifvalidate_diddoc()fails. - Transient Failure Handling: The
validate_diddoc()function can fail for reasons other than a missing DID document, such as transient network errors when communicating with the keystore or the repository. When this happens during application startup, a new DID document and new keys are generated, leading to new secrets being stored in AWS Secrets Manager.
Proposed Solution
Modify the initialization logic in crates/web-plugins/did-endpoint/src/plugin.rs to only generate a new DID document if one does not already exist in the persistent storage (MongoDB).
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels