Expand description
JWKS fetching and key cache.
Keys are fetched from the configured JWKS URI and cached by kid. An unknown
kid triggers a refresh (throttled), which is how key rotation is picked up.
The cached set also ages out: a lookup after JwksCache::with_max_age
refetches it, so a key the provider has removed stops verifying tokens even
when no request ever names an unknown kid.
Structs§
- Jwks
Cache - Fetches and caches JWKS keys by
kid. - Verifying
Key - A decoding key plus the signature algorithm it is valid for.
Constants§
- DEFAULT_
MAX_ AGE - Default age after which the cached keys are refetched: the
cache_durationEnvoy’sremote_jwksuses.