The JWKS refresh interval is hardcoded at 1 hour in jwt.go. If Dex rotates signing keys, gitea-mcp will reject valid JWTs issued with the new key for up to 60 minutes.
File:internal/auth/jwt.go:44
Suggestion:
Make configurable via JWKS_REFRESH_INTERVAL env var (e.g. 15m, 1h)
Default to current 1h to preserve existing behaviour
Log the configured value at startup
The JWKS refresh interval is hardcoded at 1 hour in `jwt.go`. If Dex rotates signing keys, gitea-mcp will reject valid JWTs issued with the new key for up to 60 minutes.
**File:** `internal/auth/jwt.go:44`
**Suggestion:**
- Make configurable via `JWKS_REFRESH_INTERVAL` env var (e.g. `15m`, `1h`)
- Default to current 1h to preserve existing behaviour
- Log the configured value at startup
Mis-located. The cited internal/auth/jwt.go:44 left this repo in 658f4ba — the JWKS validator now lives in the shared mcp-chassis module (auth/jwt.go, NewJWTValidator). The hardcoded jwk.WithMinRefreshInterval(time.Hour) is there, not here. Fixing it in chassis fixes it for every consumer at once.
Refiled with accurate citations + an API-shape decision (variadic option vs breaking param): mcp-chassis#1.
Recommend closing this as moved → mcp-chassis#1.
Mis-located. The cited `internal/auth/jwt.go:44` left this repo in `658f4ba` — the JWKS validator now lives in the shared `mcp-chassis` module (`auth/jwt.go`, `NewJWTValidator`). The hardcoded `jwk.WithMinRefreshInterval(time.Hour)` is there, not here. Fixing it in chassis fixes it for every consumer at once.
Refiled with accurate citations + an API-shape decision (variadic option vs breaking param): **mcp-chassis#1**.
Recommend closing this as moved → mcp-chassis#1.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The JWKS refresh interval is hardcoded at 1 hour in
jwt.go. If Dex rotates signing keys, gitea-mcp will reject valid JWTs issued with the new key for up to 60 minutes.File:
internal/auth/jwt.go:44Suggestion:
JWKS_REFRESH_INTERVALenv var (e.g.15m,1h)Mis-located. The cited
internal/auth/jwt.go:44left this repo in658f4ba— the JWKS validator now lives in the sharedmcp-chassismodule (auth/jwt.go,NewJWTValidator). The hardcodedjwk.WithMinRefreshInterval(time.Hour)is there, not here. Fixing it in chassis fixes it for every consumer at once.Refiled with accurate citations + an API-shape decision (variadic option vs breaking param): mcp-chassis#1.
Recommend closing this as moved → mcp-chassis#1.