search

keratin / authn

Prototype version of AuthN service. See: keratin/authn-server
https://keratin.tech
GNU Lesser General Public License v3.0
34 stars 0 forks source link

key rotation #23

Closed cainlevy closed 7 years ago

cainlevy commented 7 years ago

The AuthN server should be able to rotate keys. This means keeping old keys around long enough to verify existing JWTs while signing new JWTs with the new key. The trick will be figuring out an appropriate waiting period for refresh tokens.

Also see: http://openid.net/specs/openid-connect-core-1_0.html#RotateSigKeys

cainlevy commented 7 years ago

Ahh, correction: the refresh tokens are (and should continue to be) secured separately. So really, key rotation can happen at some interval based on access token lifespans.