From 4650e7299fc194dfd3c61b0317a5b9d322335ab9 Mon Sep 17 00:00:00 2001 From: steve-chavez Date: Thu, 11 Sep 2025 14:14:36 -0500 Subject: [PATCH] chore(changelog): add breaking change for JWT kid --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 420bf6034..d2afeb223 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -122,6 +122,9 @@ This project adheres to [Semantic Versioning](http://semver.org/). - #3956, Drop `/config` endpoint of admin server - @steve-chavez + The endpoint was at risk of being left unprotected when exposing it. + The accompanying `admin-server-config-enabled` config was also dropped. + - #3598, PostgREST now validates the `kid` parameter of the JWT - @wolfgangwalther + + If the JWT contains a ``kid`` parameter, then PostgREST will look for the JSON Web Key in the `jwt-secret`. + + If the JWT doesn't contain a `kid`, the behavior should be backwards compatible. PostgREST will try each key in the `jwt-secret` one by one until it finds one that works. - #3697, #3602, Querying non-existent table now returns `PGRST205` error instead of empty json - @taimoorzaeem - #3600, #3926, Improve JWT errors - @taimoorzaeem + Return `PGRST301` error when `Bearer` in auth header is sent empty