mattcasters commented on PR #8335: URL: https://github.com/apache/hop/pull/8335#issuecomment-5653871340
Thanks @bamaer — all six points from your review are addressed in the latest push: 1. Longest prefix across built-in and plugin tables (built-in wins a tie); nested plugin paths under a built-in prefix are rejected. 2. JWKS `JWKSource` is cached per `jwks_uri` alongside discovery. 3. Bearer coverage for `HopBearerSupport`, BASIC/OIDC filters, and `JdbcTokenServlet` (accept/reject, no session, header beats ambient session, garbage → 401 + `WWW-Authenticate`). 4. `iss` and `aud` are required on ID-token validation. 5. Revocation limits documented in hop-web.adoc and the Copy JDBC token clipboard message. 6. Local `jdbc-token.secret` is set to owner-only (`0600`), with a log if it stays group/world-readable. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
