sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

JWKS cache never expires — key rotation requires restart #58

New Issue
Open
opened 2026-03-30 13:28:52 +00:00 by sharang · 0 comments
sharang commented 2026-03-30 13:28:52 +00:00
Owner
Copy Link
Copy Source

fetch_or_get_jwks caches JWKS forever. When Keycloak rotates signing keys, all new tokens are rejected until the process restarts. Fix: Add TTL (5 min) and force-refresh fallback when kid is not found.

fetch_or_get_jwks caches JWKS forever. When Keycloak rotates signing keys, all new tokens are rejected until the process restarts. Fix: Add TTL (5 min) and force-refresh fallback when kid is not found.
sharang added the bugsecurityv0.3.0critical labels 2026-03-30 13:28:52 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels bug critical security v0.3.0
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#58