search

hasura / graphql-engine

Blazing fast, instant realtime GraphQL APIs on your DB with fine grained access control, also trigger webhooks on database events.
https://hasura.io
Apache License 2.0
31.18k stars 2.77k forks source link

Hasura JWT_MODE with type ES256 using Cognito + ALBs #6664

Open tkim90 opened 3 years ago

tkim90 commented 3 years ago

It seems like Hasura doesn't support JWT validation for tokens using the ES256 algo, which is what the ALB (Amazon Load Balancer) tokens use.

ALBs use an ES256 JWT and public-key uri https://public-keys.auth.elb.${region}.amazonaws.com/${kid} for validation, whereas Hasura requires a jwk_url.

If that's the case, what are the workarounds? Or is it not possible?

My idea was to create a custom JWT validation Action handler, then funnel all GraphQL requests through it, but that seems hacky. Any ideas?

alexandrim0 commented 3 years ago

https://github.com/hasura/graphql-engine/issues/6249