Graphql-engine: server should start even when JWK server is down

[wenerme]

1. Hasura use jwk url to fetch pub keys
2. the jwk is hosted by a nextjs server
3. the server use admin secret to get jwk from hasura from db

Due to the early initializing of jwk, the server can not get jwk from hasura, hasura can not startup.

If hasura can delay jwk initialize when needed can break the dependency cycle.

[0x777]

Maybe you can break the cycle by adding the keys that your nextjs server requires as environment variables?

[wenerme]

The key is generated at first run, then persist to db. My workaround is use a fake jwk when first request jwk if hasura init failed, then refetch key from hasura, and save key to temp file. But have to restart hasura to make it fetch jwk again.

[ecthiender]

the server use admin secret to get jwk from hasura from db

You can bypass Hasura and directly connect to the db to get the JWK?

[wenerme]

expose db config to node app is not an option, maybe this case is very rare, if not interest can close this issues.

[0x777]

Adding a delay for fetching the JWK delay would be outside of our scope, however I think there is a different way to look at this problem. A more useful feature would be if graphql-engine can start even if the JWK server is not reachable during the startup, in such cases, it should keep retrying in the background to get the configuration from the JWK server. During this time, serving requests through admin secret is possible but any queries with JWT should result in an internal error.

This should also solve your issue and I'm changing the title of the issue to reflect the above.

[wenerme]

This will work, when this implemented, I don't need to return fake jwks, just throw 404.

Also, current version(1.0) will add content-type: application/json when fetch jwks, this is incorrect. Take a long time to find out, I use nextjs as server, they don't allowed this before. https://github.com/zeit/next.js/issues/9834