Struct RemoteJwksDecoder 

pub struct RemoteJwksDecoder { /* private fields */ }

JWT decoder that fetches and caches keys from a remote JWKS endpoint.

Automatically fetches JWKS from the specified URL, caches keys by their kid (key ID), and periodically refreshes them. Includes retry logic for robustness.

Example

use axum_jwt_auth::RemoteJwksDecoder;
use jsonwebtoken::{Algorithm, Validation};

let decoder = RemoteJwksDecoder::builder()
    .jwks_url("https://example.com/.well-known/jwks.json".to_string())
    .validation(Validation::new(Algorithm::RS256))
    .build()
    .unwrap();

// Spawn background refresh task
let decoder_clone = decoder.clone();
tokio::spawn(async move {
    decoder_clone.refresh_keys_periodically().await;
});

Implementations

impl RemoteJwksDecoder

pub fn new(jwks_url: String) -> Result<Self, Error>

Creates a new RemoteJwksDecoder with the given JWKS URL and default settings.

Errors

Returns Error::Configuration if the builder fails to construct the decoder.

pub fn builder() -> RemoteJwksDecoderBuilder

Creates a new builder for configuring a remote JWKS decoder.

pub async fn refresh_keys_periodically(&self)

Runs an infinite loop that periodically refreshes the JWKS cache.

This method never returns and should be spawned in a background task using tokio::spawn. Refresh failures are logged, and the decoder continues using stale keys until the next successful refresh.

Example

let decoder = RemoteJwksDecoder::builder()
    .jwks_url("https://example.com/.well-known/jwks.json".to_string())
    .build()
    .unwrap();

let decoder_clone = decoder.clone();
tokio::spawn(async move {
    decoder_clone.refresh_keys_periodically().await;
});

Trait Implementations

impl Clone for RemoteJwksDecoder

fn clone(&self) -> RemoteJwksDecoder

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T> JwtDecoder<T> for RemoteJwksDecoder

where T: for<'de> DeserializeOwned,

fn decode<'life0, 'life1, 'async_trait>( &'life0 self, token: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<TokenData<T>, Error>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Decodes and validates a JWT token string, returning the parsed claims.