Repository navigation
feat(auth): add HA-compatible sandbox JWT refresh replay protection #1506
Description
Description
Implement HA-compatible replay protection for sandbox gateway JWT refresh. Gateway-minted sandbox tokens should carry a jti or refresh generation claim, and refresh handling should reject reused or stale credentials while remaining compatible with multiple gateway replicas.
Context
Follow-up from PR #1404 review point 4. This is separate from the immediate per-sandbox auth hardening because it needs a replicated or persistent refresh-state design.
Definition of Done
- Sandbox JWTs include a
jtior refresh generation claim. - Refresh validates the current generation using storage that works across gateway replicas.
- Refresh rotates or advances generation and rejects reused tokens after the chosen grace policy.
- Tests cover stale-token rejection, replay rejection, and multi-replica-compatible state behavior.
Activity
github-actions commentedon Jun 14, 2026
This issue has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity. Comment or remove the state:stale label to keep it open.
github-actions commentedon Aug 30, 2026
This issue has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity. Comment or remove the state:stale label to keep it open.
github-actions commentedon Oct 13, 2026
Closing this issue after 14 days with no activity since it was marked stale. Reopen it if the work is still relevant.