Ignoring invalid keys in a JWKS does not work

[timw6n]

Summary.

Expected Result

A JWKS that contains two keys, one with a supported curve, one unsupported, should result in the valid key being output.

That is the clear intention of the code here in __init__ of PyJWKSet:

        for key in keys:
            try:
                self.keys.append(PyJWK(key))
            except PyJWKError:
                # skip unusable keys
                continue

Actual Result

An jwt.exceptions.InvalidKeyError is thrown to the top level.

I think the issue is that it is PyJWKError that is being caught but that InvalidKeyError extends PyJWTError. I don't know the codebase at all really, but suspect catching the broader exception would resolve the issue.

Reproduction Steps

We saw this with a JWKS containing a key with crv "X25519".

System Information

{
  "cryptography": {
    "version": "38.0.4"
  },
  "implementation": {
    "name": "CPython",
    "version": "3.10.6"
  },
  "platform": {
    "release": "6.0.0-1011-oem",
    "system": "Linux"
  },
  "pyjwt": {
    "version": "2.6.0"
  }
}

[timw6n]

Raised #863 with a patch. This seems to work for our project.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days