use jwt.kid to find correct signing key

keratin / authn-rb

Ruby client library for Keratin AuthN

https://github.com/keratin/authn

GNU Lesser General Public License v3.0

23 stars 3 forks source link

use jwt.kid to find correct signing key #2

Closed cainlevy closed 7 years ago

cainlevy commented 7 years ago

Compatibility with https://github.com/keratin/authn/pull/36.

Identity tokens include a kid. Use that to select the correct signing key from the issuer's JWK set. If no kid is present, pick any key and expect the token to not verify.