Jibri is not sending webhook Authorization header

Developers
1

I have set webhooks jwt token but jibri is not sending on status update.

It looks like jwt is configured properly.

Logs from jibri.

MainKt.main#55: Jibri starting up with id i-0df5096ee9f8c0a2a
2022-09-12 15:37:56.504 INFO: [1] JwtInfo$Companion.fromConfig#176: got jwtConfig: {
    # /etc/jitsi/jibri/jibri.conf: 56
    "audience" : "aud1",
    # /etc/jitsi/jibri/jibri.conf: 55
    "issuer" : "jibri",
    # /etc/jitsi/jibri/jibri.conf: 54
    "kid" : "jibri/recorder",
    # /etc/jitsi/jibri/jibri.conf: 53
    "signing-key-path" : "/etc/jitsi/jibri/private.pem",
    # /etc/jitsi/jibri/jibri.conf: 57
    "ttl" : "10 minute"
}

I made sure that rsa key exists and valid.

Request made from jibri:

image

2

Send it where? How did you configure jibri?

3

To the webhooks subscriber endpoints.

Ref: jibri/reference.conf at 260cee3a118462aa419ff3b2e0ca2ac4645b7a92 · jitsi/jibri · GitHub

You can see my screenshot above jibri is posting its states to the /v1/status but authorization header is not present despite configured.

4

Hum, looks like that header should be there: jibri/WebhookClient.kt at 8f198ae2c7c44622ccca73914dcdce72c3162da8 · jitsi/jibri · GitHub

5

Yeah, sadly it is not. Logs also show jwt configurations are loaded properly.

6

@oianc any idea?

7

@deben Can you share the Jibri logs? Also, does the webhook work without Auth header?

8

yes, it is sending webhooks but without Auth header.

As I was pointing out these are the logs jibri supposed to be loading jwt config.


MainKt.main#55: Jibri starting up with id i-0df5096ee9f8c0a2a
2022-09-12 15:37:56.504 INFO: [1] JwtInfo$Companion.fromConfig#176: got jwtConfig: {
    # /etc/jitsi/jibri/jibri.conf: 56
    "audience" : "aud1",
    # /etc/jitsi/jibri/jibri.conf: 55
    "issuer" : "jibri",
    # /etc/jitsi/jibri/jibri.conf: 54
    "kid" : "jibri/recorder",
    # /etc/jitsi/jibri/jibri.conf: 53
    "signing-key-path" : "/etc/jitsi/jibri/private.pem",
    # /etc/jitsi/jibri/jibri.conf: 57
    "ttl" : "10 minute"
}
9

@oianc any update on this?

10

Hi! We were able to reproduce this issue. The problem is that even if the JwtInfo config is read correctly, it is read after the JWT used in the request was initialised. We don’t know yet why this happens, will look more into it in the following days.

11

@RalucaT @oianc
Any update on this we’re really scared someone can discover this bug and screw our system with forged payload and spin thousands of instances.

12

Hi! This is on our backlog and we are planning to work on addressing this in the following weeks, we will keep you posted.

1 Like
13

We’ve reproduced the issue and found a root cause.
Currently testing the fix.

1 Like
14

the fix: fix: Authorization header sending for webhooks by cristianbotiza · Pull Request #493 · jitsi/jibri · GitHub

1 Like
15

Thanks a lot @cbotiza !

16

Thanks @cbotiza .

Any idea when it will land on stable repo?

17

hi @deben, we’re aiming for sometime next week.

1 Like
18

The latest jibri is in stable since yesterday.

3 Likes
19

I don’t know if I needed to create new topic, but I’m posting it here anyway, I guess it might have something to do with this behavior.

Jibri is sending expired JWT tokens not respecting the TTL from configuration, same token is being sent over and over without being refreshed.

20

Ping @cbotiza