mirror of
https://github.com/SigNoz/signoz.git
synced 2026-09-20 18:30:41 +01:00
#### Description - `tokenizer.Config.Validate()` now rejects an empty `tokenizer::jwt::secret` when `tokenizer::provider` is `jwt`. An empty secret signs and verifies tokens with an empty key, so anyone can mint a valid token. - Drops the startup log in `jwttokenizer` that flagged the missing secret and carried on, config validation now fails the boot instead. #### Additional Information Breaking change: a deployment running `tokenizer.provider: jwt` without `SIGNOZ_TOKENIZER_JWT_SECRET` (or the deprecated `SIGNOZ_JWT_SECRET`) will fail to start until a secret is set. The default provider is `opaque`, which is unaffected.