JWT issued before application image rebuild does not work after image build/deploy

Question

My app uses a SPA client and Phoenix/Elixir backend, with jwt authentication (via Guardian library). The app is deployed using Docker on GCP.

I'm having the below issue:

1. I'm an authenticated user that has been issued a jwt. Everything works fine.

2. The production application's docker image is rebuilt, redeployed, and the server is restarted.

3. My jwt token issued before the rebuild is no longer valid.

I'm having trouble finding what would be causing this. Looks like the secret key used in config.exs Guardian config will always be the same across builds.

Any help is appreciated!

Answer 1

Either the contents of the payload are being used to validate the message, and some field has changed in a way that the JWT is considered invalid by the server, or the secret actually has changed and your assertion is not correct.

The way I would problem solve this is by using a pre-developed tool to verify the JWT. Either your secret key can be used to validate the signature or it can't. No need to "guess".