createRemoteJwksKeyResolver

createRemoteJwksKeyResolver

Creates a key resolver that reads a JWK Set from one trusted URL.

Behaviour, per resolver:

• The first verification fetches the set. Later ones reuse it while fresh. Freshness is the remaining lifetime from Cache-Control: max-age, else Expires, else defaultTtlMs, less the response age (the larger of the apparent age from Date and Age plus the transit delay), capped at maxTtlMs. no-store, no-cache and a lifetime already spent leave none: the set serves the verification that fetched it and nothing after. No heuristic freshness is applied.
• A set that is no longer fresh is never used, whether or not a refresh succeeds. There is no stale-if-error. A refresh that fails while the cached set is still fresh keeps that set until it expires.
• Refreshes are separate from freshness: after any attempt the next one waits cooldownMs. Within that interval a token whose kid is absent gets key_not_found, and a token that needs a set that is no longer fresh gets jwks_unavailable. Concurrent verifications share a single request, and unknown kid values are never cached.
• A refresh replaces the whole set, so a rotated-out key stops verifying as soon as the new set is read. Rotation must therefore introduce a new kid.
• The whole request, response body included, is bounded by timeoutMs and enforced even when the transport ignores the abort signal. Redirects, bytes and keys are bounded by redirects, maxResponseBytes and maxKeys. No retry happens inside a fetch. Cancelling the last waiting verification aborts the request, and a response that finishes afterwards is discarded.
• Request headers go only to the configured origin. jku, x5u and jwk headers are never used.

Throws a ResultError coded RemoteJwksConfigErrorCode for unusable configuration. Redirect destinations, and the addresses a hostname resolves to, are limited by redirects and the transport; this module cannot see DNS answers, and browsers hide redirect targets.

function createRemoteJwksKeyResolver(
	config: RemoteJwksConfig,
): JwsKeyResolver

Parameters

• config: RemoteJwksConfig