diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index f0c10dd5ea..228c86e036 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -1041,9 +1041,11 @@ App::post('/v1/account/jwt') ->label('abuse-key', 'url:{url},userId:{userId}') ->inject('response') ->inject('user') - ->action(function ($response, $user) { + ->inject('project') + ->action(function ($response, $user, $project) { /** @var Appwrite\Utopia\Response $response */ /** @var Utopia\Database\Document $user */ + /** @var Utopia\Database\Document $project */ $sessions = $user->getAttribute('sessions', []); $current = new Document(); @@ -1060,7 +1062,7 @@ App::post('/v1/account/jwt') throw new Exception('No valid session found', 404, Exception::USER_SESSION_NOT_FOUND); } - $jwt = new JWT(App::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 900, 10); // Instantiate with key, algo, maxAge and leeway. + $jwt = new JWT($project->getId() == 'console' ? App::getEnv('_APP_OPENSSL_KEY_V1') : $project->getAttribute('jwtSecret'), 'HS256', 900, 10); // Instantiate with key, algo, maxAge and leeway. $response->setStatusCode(Response::STATUS_CODE_CREATED); $response->dynamic(new Document(['jwt' => $jwt->encode([ diff --git a/app/controllers/api/functions.php b/app/controllers/api/functions.php index d491b7d75b..79ab167088 100644 --- a/app/controllers/api/functions.php +++ b/app/controllers/api/functions.php @@ -899,7 +899,7 @@ App::post('/v1/functions/:functionId/executions') } if(!$current->isEmpty()) { - $jwtObj = new JWT(App::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 900, 10); // Instantiate with key, algo, maxAge and leeway. + $jwtObj = new JWT($project->getId() == 'console' ? App::getEnv('_APP_OPENSSL_KEY_V1') : $project->getAttribute('jwtSecret'), 'HS256', 900, 10); // Instantiate with key, algo, maxAge and leeway. $jwt = $jwtObj->encode([ 'userId' => $user->getId(), 'sessionId' => $current->getId(), diff --git a/app/init.php b/app/init.php index c22ef18d14..f39124fb97 100644 --- a/app/init.php +++ b/app/init.php @@ -709,7 +709,7 @@ App::setResource('user', function($mode, $project, $console, $request, $response $authJWT = $request->getHeader('x-appwrite-jwt', ''); if (!empty($authJWT) && !$project->isEmpty()) { // JWT authentication - $jwt = new JWT(App::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 900, 10); // Instantiate with key, algo, maxAge and leeway. + $jwt = new JWT($project->getId() == 'console' ? App::getEnv('_APP_OPENSSL_KEY_V1') : $project->getAttribute('jwtSecret'), 'HS256', 900, 10); // Instantiate with key, algo, maxAge and leeway. try { $payload = $jwt->decode($authJWT);