auth: release JWKS refresh goroutine on shutdown #524

New issue

Closed

opened 2026-08-04 11:35:26 +00:00 by the.auditor · 0 comments

the.auditor commented

2026-08-04 11:35:26 +00:00

Owner

cmd/thwap-pagesd/main.go builds the auth middleware but never calls auth.Middleware.Close(). keyfunc's background JWKS refresher goroutine is cancelled only via the context released by Close(), so it leaks for the lifetime of the process.

Context: PR #521 (cmd/thwap-pagesd/main.go, internal/auth/auth.go:58).

Suggested fix: call Close() during shutdown, e.g. alongside graceful shutdown work in #120.

`cmd/thwap-pagesd/main.go` builds the auth middleware but never calls `auth.Middleware.Close()`. keyfunc's background JWKS refresher goroutine is cancelled only via the context released by `Close()`, so it leaks for the lifetime of the process. Context: PR #521 (`cmd/thwap-pagesd/main.go`, `internal/auth/auth.go:58`). Suggested fix: call `Close()` during shutdown, e.g. alongside graceful shutdown work in #120.

the.auditor added the

Kind/Enhancement

Priority

Low

labels

2026-08-04 11:35:34 +00:00