Skip to content

Fix cookie policy for Seqera Platform JWT token refresh#6411

Merged
pditommaso merged 3 commits intomasterfrom
fix/jwt-token-cookie-policy
Sep 18, 2025
Merged

Fix cookie policy for Seqera Platform JWT token refresh#6411
pditommaso merged 3 commits intomasterfrom
fix/jwt-token-cookie-policy

Conversation

@pditommaso
Copy link
Member

Summary

  • Updates lib-httpx dependency to version 2.1.0 across affected modules
  • Configures CookiePolicy.ACCEPT_ALL for JWT token refresh functionality
  • Fixes cookie handling in Tower and Wave clients for proper authentication token refresh

Changes

  • modules/nf-commons: Bump lib-httpx from 2.0.0 to 2.1.0
  • plugins/nf-tower: Update lib-httpx dependency and configure cookie policy for TowerClient, TowerFusionToken, and TowerXAuth
  • plugins/nf-wave: Update lib-httpx dependency and configure cookie policy for WaveClient

Test plan

  • Verify Tower authentication and token refresh works correctly
  • Verify Wave service integration maintains proper authentication
  • Run existing integration tests for Tower and Wave plugins

🤖 Generated with Claude Code

Update lib-httpx to version 2.1.0 and configure cookie policy to ACCEPT_ALL
for proper JWT token refresh handling in Tower and Wave clients.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>
@pditommaso pditommaso requested a review from jordeu September 17, 2025 21:02
@pditommaso
Copy link
Member Author

@jordeu any chance you can validate this?

@jordeu
Copy link
Collaborator

jordeu commented Sep 18, 2025

@jordeu any chance you can validate this?

Ok, let me launch a +1h pipeline to validate

Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>
… prod]

Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>
@pditommaso pditommaso force-pushed the fix/jwt-token-cookie-policy branch from 7528ff9 to 20baecf Compare September 18, 2025 11:55
@pditommaso
Copy link
Member Author

I'll merge this, however validation would still be important

@pditommaso pditommaso merged commit c3959cf into master Sep 18, 2025
10 checks passed
@pditommaso pditommaso deleted the fix/jwt-token-cookie-policy branch September 18, 2025 14:49
@jordeu
Copy link
Collaborator

jordeu commented Oct 14, 2025

Sorry, I couldn't validate before. I've checked with the 25.09.1-edge version, and we are still getting this exception after one hour of running:

WARN  nextflow.fusion.FusionEnvProvider - Unable to validate Fusion license - reason: Unauthorized [401] - Verify you have provided a Seqera Platform valid access token

@pditommaso
Copy link
Member Author

umm, i've tested locally using a short lived jwt token and it was refreshing correctly

@jordeu
Copy link
Collaborator

jordeu commented Oct 14, 2025

umm, i've tested locally using a short lived jwt token and it was refreshing correctly

Yes, I also tested this part, but not altogether. Not sure what is going on, but that cookie problem might not be the full solution.

@pditommaso
Copy link
Member Author

Re-opening this, @jorgee can you please have a look (context, @jordeu is reporting the jwt token is not updated with when checking the fusion license)

@nextflow-io nextflow-io deleted a comment from netlify bot Oct 21, 2025
@pditommaso
Copy link
Member Author

(oops, this is a PR and it cannot be re-opened)

@jorgee
Copy link
Contributor

jorgee commented Oct 23, 2025

Looking at this now. Just to check if I correctly understood the issue. Nextflow needs a jwt token for validating the fusion license. This token expires, and the httpx client refreshes it, but something fails after refreshing that we get 401 when checking the license. It can be reproduced running a pipeline with fusion and wave enabled with a duration larger than 1 hour. Is it correct? or do I miss something?

@pditommaso
Copy link
Member Author

Yeah, but it much simpler using a local platform instance and setting jwt lifespan to a few mins. Let's chat over slack

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants