KemalIdentity::JWT::JWKS

The floor between two fetches provoked by an unknown kid.

Without it, a stream of tokens carrying invented kids is a way to make this process hammer the identity provider — a denial of service pointed at somebody else, triggered by unauthenticated traffic.

How long to wait on the provider before giving up.

docs/06-roadmap.md asks for "a cached JWKS with a timeout", and this is why: without one a provider that accepts connections and never answers holds a fiber per request until something else breaks.

How long a fetched key set is used before it is fetched again.

Ten minutes: short enough that a rotation propagates on its own, long enough that the provider is not part of the hot path. Providers publish Cache-Control on this endpoint and this deliberately does not read it — a header from the thing being verified is not a good input to how long you trust it.

Largest JWKS document accepted. A key set is a few kilobytes; this is the bound that stops a hostile or broken endpoint from being answered with a stream that never ends.

Parses a JWKS document into a keyring.

Entries this shard cannot use — an unsupported kty, an alg outside the allow-list, a modulus too short — are skipped rather than fatal. A provider publishing one EC key beside three RSA ones is normal, and refusing the whole document over it would take the application down for a key it was never going to use. A document with nothing usable in it is fatal, because that is indistinguishable from a document for another service.

The current key set, fetching if there is none or the cached one has expired.

Raises InfrastructureError when there is nothing usable and the provider cannot be reached. A stale-but-present ring is preferred to that: a provider outage should not sign every one of your users out, and a key that verified a minute ago has not become dangerous because a fetch failed.

Refetches because a token named a kid the ring does not hold — which is what a rotation looks like from here, and also what a hostile stream of invented kids looks like. minimum_refresh_interval is what tells them apart cheaply.