fix: pass seconds (not ms) to Redis EXPIRE for admin signature replay cache - #3963
Open
SashaMIT wants to merge 1 commit into
Open
fix: pass seconds (not ms) to Redis EXPIRE for admin signature replay cache#3963SashaMIT wants to merge 1 commit into
SashaMIT wants to merge 1 commit into
Conversation
… cache canApiSignatureBeProcessed multiplied the configured TTL by 1000 for the Date.now() age check, then reused that millisecond value in redis.expire. Redis EXPIRE takes seconds, so replay-cache keys lived 1000x longer than intended (default 30s → ~8.3h) in both backend and auth. Keep ms for the age check; pass ttlSeconds to EXPIRE. Assert redis.ttl stays within the configured second window. Co-authored-by: Cursor <cursoragent@cursor.com>
✅ Deploy Preview for brilliant-pasca-3e80ec canceled.
|
github-actions
Bot
added
type: tests
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
canApiSignatureBeProcessed(backend and auth) computesttlMilliseconds = adminApiSignatureTtlSeconds * 1000for theDate.now()signature-age check, then passes that same value toredis.expire.Redis
EXPIREtakes seconds. With the defaultADMIN_API_SIGNATURE_TTL_SECONDS=30, replay-cache keys were retained for ~30000 seconds (~8.3 hours) instead of 30 seconds.Direction is fail-safe for replay protection (keys live longer than intended), but it causes unnecessary Redis memory retention under admin traffic. The auth session store already converts correctly (
expireInSec = maxAgeMs / 1000 + 10inauth/src/app.ts).Fix
ttlSecondstoredis.expirein both packages.redis.ttl(signature:…)is within the configured second window (a ms/seconds mixup would leave TTL ≈ttlSeconds * 1000).Verification
Local unit-mismatch repro (no Redis required): default 30s config → code previously passed
30000to EXPIRE → 8.33h TTL. Full Jest suites need the Postgres/Redis testcontainers environment.Made with Cursor