/.well-known/jwks.json is not registered with IANA, violating a MUST in RFC 5785

[andersk]

Preflight checklist

• [X] I could not find a solution in the existing issues, docs, nor discussions.
• [X] I agree to follow this project's Code of Conduct.
• [X] I have read and am following this repository's Contribution Guidelines.
• [ ] I have joined the Ory Community Slack.
• [ ] I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

Ory Hydra is using the /.well-known/jwks.json URI, but this URI is not registered in the IANA well-known URIs registry. This violates a hard requirement of RFC 5785 that all /.well-known/ URIs MUST be registered:

A well-known URI is a URI [RFC3986] whose path component begins with the characters "/.well-known/", and whose scheme is "HTTP", "HTTPS", or another scheme that has explicitly been specified to use well-known URIs.

Applications that wish to mint new well-known URIs MUST register them, following the procedures in Section 5.1.

This registration requirement is important to avoid colliding uses of /.well-known/ URIs with different semantics.

Related:

• gravitational/teleport#46194

Reproducing the bug

See https://www.ory.sh/docs/hydra/reference/api#tag/wellknown/operation/discoverJsonWebKeys and

https://github.com/ory/hydra/blob/57096be9befbde4a1436ef48338d253a248c91c4/jwk/handler.go#L32

Relevant log output

No response

Relevant configuration

No response

Version

2.2.0

On which operating system are you observing this issue?

None

In which environment are you deploying?

None

Additional Context

No response

[aeneasr]

Sorry, but this is nonsense. This endpoint is part of the OIDC spec.

edit:// It might not be explicitly in there, but it’s common practice to be under this URL for many auth servers. Changing this has no effect other than a breaking change and time and effort for everyone, while gaining nothing.

[andersk]

If the URL is not going to be changed, then it should be registered.

[aeneasr]

We are such a small project and don’t have the resources nor the connections to influence IANA. Please reach out to one of the many other players in the market, like Okta to formalize the endpoint: https://www.google.com/search?q=%22.well-known%2Fjwks.json

[andersk]

Okta uses /oauth2/v1/keys, not /.well-known/jwks.json. Example: https://example.okta.com/.well-known/openid-configuration → "jwks_uri":"https://example.okta.com/oauth2/v1/keys" and https://example.okta.com/.well-known/oauth-authorization-server → "jwks_uri":"https://example.okta.com/oauth2/v1/keys".

[aeneasr]

https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-key-sets