From 0a8fefc3f8007f3c65df6569e4400bf3818e9ec0 Mon Sep 17 00:00:00 2001 From: Tim Hansen Date: Fri, 6 Jan 2023 13:46:22 -0700 Subject: [PATCH] Add note about protected headers in JWT Signed-off-by: Tim Hansen --- docs/auth/service-to-service-auth.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/auth/service-to-service-auth.md b/docs/auth/service-to-service-auth.md index 7c501a8e9e..8d10fd7cc6 100644 --- a/docs/auth/service-to-service-auth.md +++ b/docs/auth/service-to-service-auth.md @@ -110,6 +110,9 @@ value of the configured key as the secret. It must also have the following paylo - `sub`: "backstage-server" (only this value supported currently) - `exp`: one hour from the time it was generated, in epoch seconds +> NOTE: The JWT must encode the `alg` header as a protected header, such as with +> [setProtectedHeader](https://github.com/panva/jose/blob/main/docs/classes/jwt_sign.SignJWT.md#setprotectedheader). + ## Granular Access Control We plan to build out the service-to-service auth to be much more powerful in the