Struct JwksCache 

#[non_exhaustive]
pub struct JwksCache { /* private fields */ }

Thread-safe JWKS key cache with automatic refresh.

Includes protections against denial-of-service via invalid JWTs:

• Refresh cooldown: At most one refresh per 10 seconds, regardless of cache misses. This prevents attackers from flooding the upstream JWKS endpoint by sending JWTs with fabricated kid values.
• Concurrent deduplication: Only one refresh in flight at a time; concurrent waiters share the same fetch result.

Implementations

impl JwksCache

pub fn new(config: &OAuthConfig) -> Result<Self, Box<dyn Error + Send + Sync>>

Build a new cache from OAuth configuration.

Errors

Returns an error if the CA bundle cannot be read or the HTTP client cannot be built.

pub async fn validate_token(&self, token: &str) -> Option<AuthIdentity>

Validate a JWT Bearer token. Returns Some(AuthIdentity) on success.

pub async fn validate_token_with_reason( &self, token: &str, ) -> Result<AuthIdentity, JwtValidationFailure>

Validate a JWT Bearer token with failure classification.

Errors

Returns JwtValidationFailure::Expired when the JWT is expired, or JwtValidationFailure::Invalid for all other validation failures.