Implement JSON Web Key Set endpoints

[maxmouchet]

https://blog.angular-university.io/angular-jwt/ https://auth0.com/docs/tokens/concepts/jwks https://auth0.com/docs/tokens/guides/locate-jwks

[maxmouchet]

https://github.com/auth0/node-jwks-rsa/tree/master/examples/express-demo

[jrebecchi]

If Krypton is set directly in express like below:

app.use(kryptonAuth());

The JSON Web Key Set endpoints are available at http://the-adress-of-krypton/.well-known/jwks.json.

If Krypton is set after a subroute in express like below:

app.use('auth', kryptonAuth());

The JSON Web Key Set endpoints are available at http://the-adress-of-krypton/auth/.well-known/jwks.json.

With that, you can easily verify the JWTs emitted by Krypton and set the decoded user data inside req.user using with jwks-rsa :

app.use(jwt({
  secret: jwksRsa.expressJwtSecret({
    cache: true,
    rateLimit: true,
    jwksRequestsPerMinute: 150,
    jwksUri: 'http://localhost:' + PORT + '/.well-known/jwks.json'
  }),
  algorithms: ['RS256']
}));

This example suppose that your client has included inside the HTTP authorization header the JWT as a bearer token.