Module discovery 

Key discovery: {iss}/.well-known/{dwk} names a jwks_uri (or carries jwks), and the key a token or signature names is found there.

Discovery runs over a Fetch, so the caller decides which HTTP client (and which SSRF guard) reaches the network, and tests need none.

Structs

Fetched

A response to a Fetch.

JwksResolver

Discovery over a Fetch, caching each issuer’s keys for ten minutes (see JwksResolver::with_ttl).

NoKeys

Resolves nothing: for verifying signatures whose scheme carries its key.

ReqwestFetchclient

Fetch over a reqwest client.

StaticFetch

Serves fixed JSON documents by URL, and 404 for anything else: for tests, and for parties that live in the same process.

Constants

MAX_DOCUMENT_BYTES

The most a fetched document may weigh. Metadata and key sets are small; anything larger is a peer misbehaving.

Traits

Fetch

An HTTP GET.

KeyResolver

Finds an issuer’s signing keys.