API tokens not working anymore

[amercader]

If you pulled the openknowledge/ckan-base or openknowledge/ckan-dev images on or after 2023-01-30 you will notice that two things happen:

• Existing login sessions will be closed, forcing users to re-login
• Existing API Tokens will no longer work

This is because due to CVE-2023-22746, changes were made to the images to ensure a unique session secret key was used when creating a container, to avoid sharing the same key across instances. As a new key will be used, old API Tokens will no longer work and will need to be re-generated.

To avoid this in the future make sure to persist the various secret keys in your .env file with the rest of your secrets:

docker-ckan/.env.example

Lines 9 to 12 in 4746d8c

	CKAN___BEAKER__SESSION__SECRET=CHANGE_ME
	# See https://docs.ckan.org/en/latest/maintaining/configuration.html#api-token-settings
	CKAN___API_TOKEN__JWT__ENCODE__SECRET=string:CHANGE_ME
	CKAN___API_TOKEN__JWT__DECODE__SECRET=string:CHANGE_ME

If you had your secrets defined in the .env file as above you won't be affected by this change (i.e. your API Tokens will keep working as expected)