if upstream is down, authentication JWT is not cached

[wasaga]

What happened?

If a destination TCP upstream is down, Pomerium serves HTTP 503 and JWT auth token would not be persisted by the CLI.

That causes two issues:

• the need to open auth URL next time an authentication attempt is made, which, in case it is done by some software that auto-retries connections, will keep opening user's browser over and over again.
• there is no indication to the user of the underlying root cause (destination upstream down).

What did you expect to happen?

• JWT auth token persisted by the CLI
• have a better user error message

[desimone]

I think it's reasonable to cache (TOFU) the JWKS.

[calebdoxsey]

have a better user error message

Is probably not possible. We intentionally don't provide detailed error messages. It's considered a security leak.