Rollover Mitigation

[ghstahl]

Using the asp.net core jwt middleware they handle the case of a jwks rollover.

What is the best practice using JWX.
Currently we use JWKs in our middleware. Is that responsibility on us or does this library handle it when a validation fails simply because we don't have a matching KID.

[lestrrat]

There are some tools like jwk.Cache that kind of works in certain cases, but in general the recovery strategy would vary from use case to use case, so in general yes, you probably need to handle it yourself. (note: I have no clue what the asp.net does, so I may be off)

[ghstahl]

That's what I suspected, it's the middleware's responsibility. The asp.net cores middleware detects that it doesn't have the kid, so it does a refresh right there. The good thing here is that everyone uses this middleware and just takes it for granted. On the go side its everyone for themselves. Looks like my middleware will need to mimic what asp.net core is doing.

Can I make jwk.Cache do a hard fetch?

[lestrrat]

voila https://github.com/lestrrat-go/jwx/blob/develop/v2/jwk/cache.go#L239-L255

[ghstahl]

thank you