AxonIQ/axon-server-se

AxonServer incorrectly handles tokens with special characters

ViliusS opened this issue · 0 comments

AxonServer does allow to set special characters, like % or " in a token and doesn't complain about it, however clients connecting with such token will always get PERMISSION_DENIED: Invalid token.

Looks like this could be a limitation of https://grpc.github.io/grpc-java/javadoc/io/grpc/Metadata.Key.html

Just spent an hour trying to find out why our AxonServer installation doesn't work with Access Control enabled, which was my own mistake actually. I set axoniq.axonserver.accesscontrol.token="mytoken" by mistake (notice the quotes). Setting it to axoniq.axonserver.accesscontrol.token=mytoken solved the issue.

Still I think AxonServer should not start with such characters in a token. At a minimum documentation needs to be very specific what's allowed and what's not, since most password/token generators allow special characters by default.