Add kid to JWKs
#221
Open
Add kid to JWKs
#221
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Use 'latest' JWK's kid in the signing headers. This is used by clients to efficiently find the right JWK from the list I noticed this was missing when trying to use hono/jwk middleware
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
@natac13 great point, for OIDC https://docs.convex.dev/auth/advanced/custom-auth we don't use Biscuit, we use https://github.com/ramosbugs/openidconnect-rs. I think using a kid is a good idea. Sorry for the trouble when using this via Hono! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Use 'latest' JWK's kid in the signing headers. This is used by clients to efficiently find the right JWK from the list
I noticed this was missing when trying to use hono/jwk middleware
Add
kidto the JWKS and the signing headers so that clients can use it to find the JWK from the list to verify.I choose, (maybe wrongly) that the 'latest' key it the first one in the list. Could go either way.
While trying to use the convex auth supplied access token from a Hono api with their jwk middleware, I got an error about the
kidfield missing.I learned that it is to uniquely identify the JWK so the client does not have to check every key in the list from the endpoint.
I check on how Openauth does this here
I found that the Convex Backend uses the Biscuit library to decode the jwks here
However, after checking on the source for the Biscuit
decode_with_jwksI am not sure how it does not throw a similar error due to the missingkidBy submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.