JWKS JWT validation

[rubiojr]

Tavern JWT tokens

Charm can now mint¹ JWT tokens with a custom audience that can be used to validate² the user publishing to a Tavern server has access to a given Charm server, without giving the Tavern server access to other Charm server resources, a simple proof the Tavern server can use to check the Tavern client trying to publish can access a Charm server (any Charm server).
The --allowed-charm-servers server flag implemented also here (see below), complements this to only allow clients from a given Charm server to publish filies, if specified.

This improves security when using trusted Tavern clients (i.e. the one you downloaded from this repo) with untrusted Tavern servers hosted by third party.

In practical terms, the Tavern client now asks the Charm server to mint a new JWT token with a tavern audience, and that JWT token is sent to the Tavern server that verifies the token is a valid token issued by that Charm server (encoded in the JWT). The Charm server only grants clients with a charm audience access its resources, so the untrusted Tavern server can't use that JWT token sent by the Tavern client to access any Charm server resources as a result.

For example, a JWT token with a tavern audience can't be used to list CharmFS files:

[rubiojr@nano tavern] curl -H "Authorization: Bearer $(charm jwt tavern)" http://localhost:35354/v1/fs/
{"message":"JWT is invalid."}

Using a trusted Tavern client is of paramount importance of course, as a rogue Tavern client could mint tokens with a charm audience, granting the Tavern server unlimited access to the Charm server.

This feature currently requires an unreleased Charm server version.

Charm server allow list

Added a Charm server allow list argument to specify which Charm servers can be used to publish on a given Tavern server, by specifying the Charm server FQDNs allowed, so you can allow publishing users of your own Charm server for example:

tavern serve --allowed-charm-servers my.charm.cloud

Multiple servers can be allowed repeating the --allowed-charm-servers flag.

By default, any user from any Charm server can publish.

Massive props ⚡ and thanks to @toby and the Charm fellas who worked with me to make this possible.

Footnotes

1. Charm PR introducing JWT custom audiences ↩

2. JWKS validation ↩