Description
On devnet-8, bombora builder returned HTTP 400 to a caller because auth.message.data differed only by a trailing slash:
Received: https://devnet8-builder-api.bombora.workers.dev/
Expected: https://devnet8-builder-api.bombora.workers.dev
Implement the default auth changes in Beacon API #642 and Keymanager API #94, following builder-specs #168. These proposals use the builder hostname instead of the full URL, so differences in URL formatting do not cause authentication mismatches.
The builder-configuration work in #9864 currently defaults omitted auth data to the full URL bytes.
Steps to resolve
- Derive omitted
auth_data in the validator client using the lowercase ASCII hostname, excluding scheme, userinfo, port, path, query and fragment. Follow the specified punycode and IPv6 rules.
- Use the same default for builder preferences and block production, including global and per-validator builder configuration.
- Keep explicitly supplied
auth_data as exact opaque bytes. The Keymanager API must not interpret or normalise it.
- Cover the upstream URL examples and explicit overrides in tests, and update configuration documentation and examples.
Builders and validator clients need matching defaults or agreed explicit auth data during the transition. The linked spec PRs are still open.
Description
On devnet-8, bombora builder returned HTTP 400 to a caller because
auth.message.datadiffered only by a trailing slash:Implement the default auth changes in Beacon API #642 and Keymanager API #94, following builder-specs #168. These proposals use the builder hostname instead of the full URL, so differences in URL formatting do not cause authentication mismatches.
The builder-configuration work in #9864 currently defaults omitted auth data to the full URL bytes.
Steps to resolve
auth_datain the validator client using the lowercase ASCII hostname, excluding scheme, userinfo, port, path, query and fragment. Follow the specified punycode and IPv6 rules.auth_dataas exact opaque bytes. The Keymanager API must not interpret or normalise it.Builders and validator clients need matching defaults or agreed explicit auth data during the transition. The linked spec PRs are still open.