MicahParks / keyfunc

Create a jwt.Keyfunc for JWT parsing with a JWK Set or given cryptographic keys (like HMAC) in Golang.
Apache License 2.0
265 stars 46 forks source link

package keyfunc returns error: the given key ID was not found in the JWKS #124

Closed jmanno01 closed 4 months ago

jmanno01 commented 4 months ago

Hi @MicahParks hope you are doing well,

your previouis answer: @jmanno01 I have not identified any issue yet. Perhaps you should look at your keyfunc.Options{} to see if too many requests are allowed. Try lowering RefreshTimeout, increasing RefreshRateLimit, ensure RefreshErrorHandler is not blocking, setting RefreshUnknownKID to false, etc. https://pkg.go.dev/github.com/MicahParks/keyfunc#Options

If you can make a full working proof-of-concept program or provide a different way to reproduce the behavior, I can help further. Not enough information has been given to help.

Answer: thanks for the feedback, ahaha i wish i could provide a poc to you

this is the way I init the jwks:

func Init(o *Options) {
    var err error
        jwksURL := "https://jwks-service.appspot.com/.well-known/jwks.json"

    if jwks, err = keyfunc.Get(jwksURL, keyfunc.Options{
        RefreshInterval:  time.Minute *10,
        RefreshTimeout:  time.Second *10,
        RefreshErrorHandler: func(err error) {
            log.Error("cannot fetch JWKS: ", err))
        },
    }); err != nil {
        log.Error(err)
        os.Exit(1)
    }
}

where RefreshInterval: time.Minute *10, RefreshTimeout: time.Second *10, RefreshErrorHandler: func(err error) { log.Error("cannot fetch JWKS: ", err)) }, spit out any error that may occur and not providing the RefreshUnknownKID is setting the variable to false by default right?

so those values should changed to prevent this error : // If the j.refreshRequests channel is full, return the error early. return nil, ErrKIDNotFound

MicahParks commented 4 months ago

This appears to be a continuation of https://github.com/MicahParks/keyfunc/issues/123

Please move any conversation back to the original ticket.