JWKS Retrieval Fails in Latest Version Despite Unchanged Request Data

[saisankar428]

After upgrading to the latest version of get-jwks, we noticed that JWKS retrieval is failing, even though the request data (including kid, domain, and alg) remains unchanged from the previous working version. The older version successfully fetches the JWKS, but the latest version throws an error or returns an unexpected response. This suggests a possible regression in the library.

We have verified that the request payload is identical between versions and checked for any missing headers or required configurations. However, the root cause remains unclear. Could you please investigate this issue?

[simoneb]

Can you provide a repro?

[saisankar428]

import type { TokenOrHeader } from '@fastify/jwt';
import fastifyJWT from '@fastify/jwt';
import config from 'config';
import type { FastifyInstance, FastifyRequest } from 'fastify';
import fp from 'fastify-plugin';
import buildGetJwks from 'get-jwks';
import https from 'node:https';

import logger from '@util/logger';

interface Options {
  addRequestHook?: boolean;
}

function securityPlugin(fastify: FastifyInstance, { addRequestHook = true }: Options = {}) {
  fastify.log.info('Plugin: Security');

  const getJwks = buildGetJwks({
    providerDiscovery: true,
    // Force IPv4 dns resolution
    agent: new https.Agent({ family: 4 }),
  });

  fastify.register(fastifyJWT, {
    secret: (_: FastifyRequest, token: TokenOrHeader) => {
      if ('payload' in token) {
        const { header, payload } = token;

        return getJwks.getPublicKey({ kid: header.kid, domain: payload.iss, alg: header.alg });**// this is where we are getting error**
      }

      throw Error('Expected a decoded token with payload');
    },
    verify: {
      allowedAud: config.get<string>('auth.audience'),
      allowedIss: config.get<string[]>('auth.issuer'),
    },
    decode: { complete: true },
    formatUser(payload) {
      return {
       sampleId: payload.sampleid,
      };
    },
  });

  if (addRequestHook) {
    fastify.addHook('onRequest', async request => {
      fastify.log.info('Validate request with JWT verification');
      try {
        await request.jwtVerify();
      } catch (err) {
        logger().error(err);
        throw err;
      }
    });
  }

  return fastify;
}

export default fp(securityPlugin);

[simoneb]

@saisankar428 this is not a reproducible repro I'm afraid, as we can't just run this code and see the issue. Please provide a minimal reproducible repro. See https://stackoverflow.com/help/minimal-reproducible-example