JWT Error #641

Open

dumarawhitebelly.tngl.sh 3mo ago

Open opened by

dumarawhitebelly.tngl.sh 3mo ago

I was able to migrate my original AT protocol user over to a self-hosted tranquil server, but now I'm getting JWT errors when trying to use Bluesky, plus I can't log in here with my server. I've tried a lot of things including trying to make the hostname match the handle domain, which didn't work. I also tried an incognito window.

Keep in mind that I'm new to this whole AT Protocol thing, and I do want to learn it the best I can. So any help is greatly appreciated. Here's a relevant part of the config.toml I have. My server is self-hosted on my PC through a Cloudflare Tunnel, fyi until I have the money for a VPS.

[server]
# Public hostname of the PDS, such as `pds.example.com`.
#
# Can also be specified via environment variable `PDS_HOSTNAME`.
#
# Required! This value must be specified.
hostname = "pds.vorasion.xyz"

# Address to bind the HTTP server to.
#
# Can also be specified via environment variable `SERVER_HOST`.
#
# Default value: "127.0.0.1"
host = "127.0.0.1"

# Port to bind the HTTP server to.
#
# Can also be specified via environment variable `SERVER_PORT`.
#
# Default value: 3000
port = 3000

# List of domains for user handles.
# Defaults to the PDS hostname when not set.
#
# Can also be specified via environment variable `PDS_USER_HANDLE_DOMAINS`.
user_handle_domains = ["vorasion.xyz"]

The error in particular is: {"error":"BadJwtSignature","message":"jwt signature does not match jwt issuer"} and this happens when Tranquil is trying to proxy to Bluesky.

ewancroft.uk 3mo ago

same happened to me. Also on own PC (on macOS arm64 via Docker) through CF Tunnels.

nel.pet 3mo ago

this happens because the bluesky appview doesnt seem to properly clear its identity cache when we migrate so it tries to validate the auth token its given against an old signing key. we've been having a hard time figuring out why since we are doing everything we need to per spec. some of the usual "poke at it to try and make the appview update" stuff usually works, update handle using the tranquil interface, deactivate and reactivate, log in to your old PDS and make sure the old account is deactivated, that kind of thing. and then just a waiting game usually. waiting for the appview to clear its cache on its own.

having issues logging in to tangled is new though. is that still persistent?

dumarawhitebelly.tngl.sh 3mo ago

I can try logging in, I just can't seem to point Tangled AT my PDS usually. That's the problem.

nel.pet 3mo ago

what do you mean point tangled at your PDS? you just give it your handle and it will find your PDS for you

dumarawhitebelly.tngl.sh 3mo ago

Yeah, I tried the handle. dumarawhitebelly.vorasion.xyz and it couldn't find the PDS.

nel.pet 3mo ago

that handle isnt a valid handle through any of the resolution mechanisms which is why tangled cant resolve it. you need to make it resolvable either with a TXT record at _atproto.dumarawhitebelly.vorasion.xyz or with https://dumarawhitebelly.vorasion.xyz/.well-known/atproto-did (preferably both). see https://atproto.com/specs/handle#handle-resolution

dogpawhat.tech 4w ago

Recently had this issue when moving from Eurosky to my own Tranquil PDS. use the EU-HAUL site, ended up with jwt issues in both BlueSky and Witchsky. I ended up deactivating EuroSky via the portal, but then Bluesky thought my account was deactivated even though I could still post on https://blacksky.community. (and even in the BlueSky app I just couldn't see the post!). Eventually I installed the goat cli and rand the goat activate account on the tranquil pds and I think the BlueSky relay/app view finally picked up the account activate event. I'm writing a quick blog post on this now.