Validator cookie

.changeset/validator-cookie-read-again-when-refused.md

@@ -0,0 +1,15 @@
+---
+default: minor
+---
+
+# zingod-source, zingod: validator cookie read again when refused; a local validator's default cookie found
+
+- A cookie (`cookie_path`) is read on the first request and again after the validator answers
+  `401` or `403`: a validator restart's new cookie is used from the request after the refusal
+  (was 401 until zingod restarted). A cookie not yet written at boot is a retried request
+  failure, never a failed start; a cookie that exists and cannot be read fails the start.
+- A `[[trusted_validators]]` entry with no credentials and a loopback `jsonrpc_address` sends no
+  credentials until the validator answers `401` or `403`, then the validator's default cookie,
+  `<cache dir>/zebra/.cookie` or `<cache dir>/zakura/.cookie`, whichever was written last
+  (neither = no auth; to pin one, set `cookie_path`). A validator at any other address is never
+  sent a local cookie.

docs/example_configs/zebrad.toml

@@ -7,7 +7,8 @@ network = "Testnet"
 [rpc]
 # zingod's [[trusted_validators]] jsonrpc_address
 listen_addr = "127.0.0.1:18232"
-# true → zebrad writes <cookie_dir>/.cookie; point zingod's [[trusted_validators]] cookie_path at it
+# true → zebrad writes <cookie_dir>/.cookie on each start; zingod reads it again when refused (default
+# cookie_dir, same user, loopback: found unset; else zingod's cookie_path)
 enable_cookie_auth = false
 cookie_dir = "<PATH_TO_ZEBRA>"
 

docs/example_configs/zingod.toml

@@ -27,7 +27,8 @@ network = "testnet"
 # - down at boot or later = retried, never fatal
 [[trusted_validators]]
 jsonrpc_address = "127.0.0.1:18232"
-# zebrad enable_cookie_auth = true
+# No credentials + a loopback address = no auth until the validator refuses, then its default
+# cookie: <cache dir>/zebra/.cookie or <cache dir>/zakura/.cookie (both = the one written last)
 # cookie_path = "<PATH_TO_ZEBRA>/.cookie"
 # basic auth
 # user = "xxxxxx"