nagisa-kunhah commented on code in PR #1542:
URL: https://github.com/apache/dubbo-admin/pull/1542#discussion_r3927502966
##########
pkg/config/console/config.go:
##########
@@ -72,6 +78,9 @@ func (c *Config) Validate() error {
if err := c.Auth.Validate(); err != nil {
return err
}
+ if c.GinMode == ReleaseMode && len(c.Auth.Providers) > 0 &&
c.Auth.SessionSecret == auth.DefaultSessionSecret {
+ return bizerror.New(bizerror.ConfigError, "auth sessionSecret
must be explicitly configured when providers are enabled in release mode")
+ }
Review Comment:
Thanks. Provider-enabled release deployments now require sessionSecret to
contain at least 32 bytes, rather than with multiple audiences must include a
matching azp. Tests cover missing, mismatched, and valid authorized-party
claims.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
