From bae8dc32831ca54e0182f68136ed304d0ff3a8b6 Mon Sep 17 00:00:00 2001 From: Taimoor Zaeem Date: Wed, 11 Oct 2023 07:22:41 +0500 Subject: [PATCH] add documentation for JWT caching (#683) --- docs/references/auth.rst | 9 +++++++++ docs/references/configuration.rst | 15 +++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/docs/references/auth.rst b/docs/references/auth.rst index 740771247..8bacf9140 100644 --- a/docs/references/auth.rst +++ b/docs/references/auth.rst @@ -114,6 +114,15 @@ To make an authenticated request the client must include an :code:`Authorization The ``Bearer`` header value can be used with or without capitalization(``bearer``). +.. _jwt_caching: + +JWT Caching +----------- + +PostgREST validates ``JWTs`` on every request. We can cache ``JWTs`` to avoid this performance overhead. + +To enable JWT caching, the config :code:`jwt-cache-max-lifetime` is to be set. It is the maximum number of seconds for which the cache stores the JWT validation results. The cache uses the :code:`exp` claim to set the cache entry lifetime. If the JWT does not have an :code:`exp` claim, it uses the config value. See :ref:`jwt-cache-max-lifetime` for more details. + Symmetric Keys ~~~~~~~~~~~~~~ diff --git a/docs/references/configuration.rst b/docs/references/configuration.rst index 6cd7217be..05fd2c8bb 100644 --- a/docs/references/configuration.rst +++ b/docs/references/configuration.rst @@ -628,6 +628,21 @@ jwt-secret-is-base64 When this is set to :code:`true`, the value derived from :code:`jwt-secret` will be treated as a base64 encoded secret. +.. _jwt-cache-max-lifetime: + +jwt-cache-max-lifetime +---------------------- + + =============== ================================= + **Type** Int + **Default** 0 + **Reloadable** Y + **Environment** PGRST_JWT_CACHE_MAX_LIFETIME + **In-Database** `n/a` + =============== ================================= + + Maximum number of seconds of lifetime for cached entries. The default :code:`0` disables caching. See :ref:`jwt_caching`. + .. _log-level: log-level