Concurrent token refresh can corrupt stored credentials (keychain key and nais-credentials.json.enc out of sync)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 55/100
Research direction
Start with getOIDCUser and storeOIDCUser in internal/naisapi/auth/oidcuser.go, including the decryption and file-write paths. Reproduce with several nais alpha mcp serve processes after token expiry, then verify nais auth print-access-token. Done means concurrent refreshes preserve a matching keychain key and encrypted credentials file, with locked read-check-refresh-store behavior and an atomic file replacement.
Written by the indexing model from the issue text.
Description
getOIDCUser (internal/naisapi/auth/oidcuser.go:68) refreshes an expired token inside the process, with no lock across processes. storeOIDCUser (:75-105) does three things on every call:
- Generates a fresh random encryption key.
- Stores that key in the keychain (:98).
- Writes
nais-credentials.json.encwith a non-atomicos.WriteFile(:163).
When two nais processes refresh at the same time, the keychain key and the file can end up written by different processes. Decryption then fails (:57-59, ErrNeedsOIDCLogin), and the user has to run nais login again. A torn read during the write has the same effect.
This happens in practice with several nais alpha mcp serve instances, one per AI agent session (navikt/cplt runs one per sandboxed session).
Suggested fix:
- Take an exclusive file lock (for example
flockon<configDir>/nais-credentials.lock) around the whole sequence: read, check validity, refresh, store. - After getting the lock, re-read the credentials, and skip the refresh if another process has already done it.
- Write the file through a temp file and rename it into place.
- Consider reusing the existing keychain key instead of rotating it on every refresh, so the key and the file can't drift apart.
Repro idea: let the access token expire, start N nais alpha mcp serve processes, and call one tool on each at the same time. Afterwards, check whether nais auth print-access-token still works.
- Dominant language
- Go
- Stars
- 2
- Forks
- 5
- Avg merge
- 2h 55m
- Merged PRs (30d)
- 30
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nais/cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 56/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 57/100
Maintainers usually reply within 1 day
-
mcp: mock schema is invalid GraphQL, so schema_* tests pass on a parse errorPossibly taken @Starefossen claimed this 1 day ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 35/100
Maintainers usually reply within 1 day
-
mcp: schema_list_queries returns an array as structuredContent, and its outputSchema is invalidPossibly taken @Starefossen claimed this 1 day ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 68/100
Maintainers usually reply within 1 day
Similar issues
-
area:web p3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Lets-Parley/Parley#912 ·
Maintainers usually reply within 1 day
-
enhancement help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Git-Hospital/githealthcheck#61 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
afreidah/s3-orchestrator#1824 ·
Maintainers usually reply within 1 day
-
Type: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
projectdiscovery/notify#569 ·
-
internal
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day