class

KemalIdentity::JWT::Keyring

Inherits Reference < Object

The keys a validator will consider, indexed by kid.

Rotation

Rotating a signing key means both keys have to verify for a while, since tokens minted under the old one are still in flight until their exp. That window is what kid is for: the issuer stamps each token with the name of the key that signed it, both keys sit in the ring, and the old one is dropped once nothing can still be carrying it. Without kid the verifier's only option is to try every key in turn, which turns key retirement into guesswork and makes a compromised key impossible to withdraw cleanly.

Selection is strict on purpose

  • A token naming a kid the ring does not hold is rejected, never retried against the other keys. A withdrawn key must stay withdrawn.
  • A token naming no kid resolves only when the ring holds exactly one key. With two or more the request is ambiguous, and guessing is how a retired key gets used again.

Constructors

new(algorithm : Algorithm, secret : Secret, id : String | Nil = nil) : Keyring

Convenience for the common single-key case.

Source
new(keys : Array(Key))
Source

Instance methods

find(kid : String | Nil) : Key | Nil

The key kid names, or nil when none applies.

Returning nil rather than raising keeps this on the failure-is-a-value path: kid arrives from the client, so an unknown one is an authentication failure, not a bug.

Source
inspect(io : IO) : Nil

Appends a String representation of this object which includes its class name, its object address and the values of all instance variables.

class Person
  def initialize(@name : String, @age : Int32)
  end
end

Person.new("John", 32).inspect # => #<Person:0x10fd31f20 @name="John", @age=32>
Source
keys
Source
size
Source
to_s(io : IO) : Nil

Appends a short String representation of this object which includes its class name and its object address.

class Person
  def initialize(@name : String, @age : Int32)
  end
end

Person.new("John", 32).to_s # => #<Person:0x10a199f20>
Source