Asymmetric (ES256) internal JWT signing - #1693

Open

omrishiv wants to merge 20 commits into

agentic-community:mainfrom

omrishiv:feat/asymmetric-signing

Commits on Aug 26, 2026

refactor: consolidate 6 self-signed token verify paths into one function
omrishiv
committed
e77c7f8
feat: ES256 keypair manager + JWKS endpoint + dual-verify dispatch
omrishiv
committed
209c55e
test: algorithm-confusion security test suite
omrishiv
committed
0508fee
feat: switch token minter to ES256 when signing key is configured
omrishiv
committed
9f73726
feat: add REJECT_HS256_TOKENS cutover lever
omrishiv
committed
3060af1
deploy: wire ES256 signing key across all deployment surfaces
omrishiv
committed
8deeac5
feat: switch internal hop tokens (mcp-proxy, registry-ui) to ES256
omrishiv
committed
3189595
feat: drop session cookie signature, rely on session_id + DB lookup
omrishiv
committed
e624d18
deploy: wire asymmetric signing vars to podman, prebuilt, terraform
omrishiv
committed
d7ecf9f
deploy: wire signing key vars into terraform ECS module
omrishiv
committed
66fad69
deploy: wire scoped encryption keys across all compose surfaces
omrishiv
committed
033b47e
docs: add all new parameters to unified reference + System Config page
omrishiv
committed
a824645
security: harden internal signing key handling and session cookies
omrishiv
committed
8bfd88e
fix: standardize signing key mount path across all deployment surfaces
omrishiv
committed
456a013
fix: accept raw session-id cookie in auth-server validate_session_cookie
omrishiv
committed
094815c
fix: verify ES256 internal hop tokens in the registry (kid dispatch + JWKS)
omrishiv
committed
e888468
mark false positive secret
omrishiv
committed
e845efb

Navigation Menu

Uh oh!

Asymmetric (ES256) internal JWT signing - #1693

Asymmetric (ES256) internal JWT signing#1693
omrishiv wants to merge 20 commits into
agentic-community:mainfrom
omrishiv:feat/asymmetric-signing

Commits on Aug 26, 2026

refactor: consolidate 6 self-signed token verify paths into one function

feat: ES256 keypair manager + JWKS endpoint + dual-verify dispatch

test: algorithm-confusion security test suite

feat: switch token minter to ES256 when signing key is configured

feat: add REJECT_HS256_TOKENS cutover lever

deploy: wire ES256 signing key across all deployment surfaces

feat: switch internal hop tokens (mcp-proxy, registry-ui) to ES256

feat: drop session cookie signature, rely on session_id + DB lookup

deploy: wire asymmetric signing vars to podman, prebuilt, terraform

deploy: wire signing key vars into terraform ECS module

deploy: wire scoped encryption keys across all compose surfaces

docs: add all new parameters to unified reference + System Config page

security: harden internal signing key handling and session cookies

fix: standardize signing key mount path across all deployment surfaces

fix: accept raw session-id cookie in auth-server validate_session_cookie

fix: verify ES256 internal hop tokens in the registry (kid dispatch + JWKS)

mark false positive secret

Commits on Aug 31, 2026

harden ES256 internal signing: deterministic kid, cutover wiring, ECS key delivery

address ES256 signing review: EKS key delivery, JWKS wiring, event-loop offload

Merge remote-tracking branch 'origin/main' into feat/asymmetric-signing