Struct HttpKeyStore

Source

pub struct HttpKeyStore { /* private fields */ }

Available on crate feature http only.

Expand description

A key store that fetches from an HTTP endpoint on every request.

This implementation does not cache keys. Every call to get_key or get_keyset will make an HTTP request.

For production use with high request volumes, wrap this in CachedKeyStore with MokaKeyCache:

use jwk_simple::jwks::{CachedKeyStore, HttpKeyStore, MokaKeyCache};
use std::time::Duration;

let remote = HttpKeyStore::new("https://example.com/.well-known/jwks.json")?;
let cache = MokaKeyCache::new(Duration::from_secs(300));
let cached = CachedKeyStore::new(cache, remote);

§Examples

use jwk_simple::jwks::{HttpKeyStore, KeyStore};

let store = HttpKeyStore::new("https://example.com/.well-known/jwks.json")?;
let key = store.get_key("my-key-id").await?;

§Custom HTTP Client

You can provide a custom reqwest::Client for full control over HTTP behavior:

use jwk_simple::jwks::HttpKeyStore;
use std::time::Duration;

let client = reqwest::Client::builder()
    .timeout(Duration::from_secs(10))
    .user_agent("my-app/1.0")
    .build()
    .unwrap();

let store = HttpKeyStore::new_with_client(
    "https://example.com/.well-known/jwks.json",
    client,
);

Implementations§

Source §

impl HttpKeyStore

Source

pub fn new(url: impl AsRef<str>) -> Result<Self>

Creates a new HttpKeyStore from a URL.

The URL must use the https scheme. To allow plain HTTP (e.g. in local development or testing), use new_insecure.

On native targets, uses a default HTTP client with a 30-second timeout. On wasm32, reqwest uses the browser/Fetch backend where client-level timeout configuration is not available. To customize the client, use new_with_client.

Source

pub fn new_with_client(url: impl AsRef<str>, client: Client) -> Result<Self>

Creates a new HttpKeyStore with a custom HTTP client.

The URL must use the https scheme. To allow plain HTTP, use new_with_client_insecure.

Use this to configure custom headers, proxies, TLS settings, and (on native targets) custom timeouts.

On wasm32, reqwest uses the browser/Fetch backend where client-level timeout configuration is not available.

§Examples

use jwk_simple::jwks::HttpKeyStore;
use std::time::Duration;

let client = reqwest::Client::builder()
    .timeout(Duration::from_secs(10))
    .build()
    .unwrap();

let store = HttpKeyStore::new_with_client(
    "https://example.com/.well-known/jwks.json",
    client,
)?;

Source

pub fn new_insecure(url: impl AsRef<str>) -> Result<Self>

Creates a new HttpKeyStore without enforcing HTTPS.

§Warning

This constructor skips the HTTPS scheme check and is intended only for local development or testing where HTTPS is not available. Do not use this in production — plain HTTP connections allow network attackers to tamper with JWKS responses and inject attacker-controlled keys.

Source

pub fn new_with_client_insecure( url: impl AsRef<str>, client: Client, ) -> Result<Self>

Creates a new HttpKeyStore with a custom HTTP client, without enforcing HTTPS.

§Warning

This constructor skips the HTTPS scheme check and is intended only for local development or testing where HTTPS is not available. Do not use this in production — plain HTTP connections allow network attackers to tamper with JWKS responses and inject attacker-controlled keys.