Skip to content

Conversation

@ilyaluk
Copy link
Contributor

@ilyaluk ilyaluk commented Mar 20, 2025

πŸ“ Summary

This implements new tool that allows to issue JWT tokens based on multiple secrets

β›± Motivation and Context

If we want to send CL requests to multiple ELs, and each of them has a different jwt secret, while keep using nginx for multiplexing, we need a way to dynamically generate JWT tokens for each EL. Engine API mandates that ELs should verify timestamp in JWT token to not be far off from current time[1], so we can't hardcode a JWT token in nginx config. To issue tokens dynamically we can use following options:

  • Use commercial nginx for jwt module[2] (or compile OS re-implementation[3])
  • Use Lua module and some libraries to work with JWT tokens[4]
  • Request tokens using with auth_request module and write an external service that would issue them.

I think the latter is the optimal option considering size of changes required.

This could be implemented in sync-proxy itself, but we don't want to use sync-proxy for multiplexing yet.

This PR also based off #17 to avoid go.mod conflicts

πŸ“š References

[1] https://github.com/ethereum/execution-apis/blob/main/src/engine/authentication.md#jwt-claims
[2] https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html
[3] https://github.com/kjdev/nginx-auth-jwt
[4] https://github.com/SkyLothar/lua-resty-jwt
[5] https://nginx.org/en/docs/http/ngx_http_auth_request_module.html


βœ… I have run these commands

  • make lint
  • make test-race
  • go mod tidy
  • I have seen and agree to CONTRIBUTING.md

@ilyaluk ilyaluk requested review from avalonche and sukoneck March 20, 2025 15:27
Base automatically changed from prepare-for-pectra to main May 12, 2025 08:53
@ilyaluk ilyaluk force-pushed the feature/jwt-tokens-service branch from 36d1bb2 to 4b072e1 Compare May 12, 2025 16:44
@ilyaluk ilyaluk merged commit 5c0ab8f into main May 12, 2025
2 checks passed
@ilyaluk ilyaluk deleted the feature/jwt-tokens-service branch May 12, 2025 16:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants