From 22358434150618b817c7c6e2e96432b92462e027 Mon Sep 17 00:00:00 2001 From: Christian Fasching Date: Thu, 20 Aug 2026 16:34:08 +0200 Subject: [PATCH] Stop the Mercure hub from accepting anonymous subscribers An unauthorised subscription was answered 200 OK and then received nothing, so a Studio tab whose cookie had expired kept a healthy looking stream with no live updates at all. Answering 401 makes that state visible and recoverable. Co-Authored-By: Claude Opus 5 (1M context) --- docker-compose.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/docker-compose.yaml b/docker-compose.yaml index ceecf1a2a..9b178f618 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -73,7 +73,14 @@ services: SERVER_NAME: ':80' MERCURE_PUBLISHER_JWT_KEY: 'CHANGE_ME_THIS_IS_MY_SECRET_KEY_THAT_IS_LONG_ENOUGH_FOR_VALIDATION' MERCURE_SUBSCRIBER_JWT_KEY: 'CHANGE_ME_THIS_IS_MY_SECRET_KEY_THAT_IS_LONG_ENOUGH_FOR_VALIDATION' - MERCURE_EXTRA_DIRECTIVES: anonymous + # Deliberately no `anonymous` directive: the hub authorises a subscription once, + # when the EventSource connects, from the mercureAuthorization cookie. With + # anonymous subscribers allowed, a connection that carries no cookie (or one that + # expired while the tab stayed open) is answered 200 OK and then receives nothing, + # so Studio keeps what looks like a healthy stream while every notification, job + # progress update and agent chat event is dropped. Answering 401 instead makes the + # state visible and lets the client re-authorise. + MERCURE_EXTRA_DIRECTIVES: '' # Uncomment the following line to enable the development mode # command: /usr/bin/caddy run -config /etc/caddy/Caddyfile.dev ports: