Skip to content

PyJWKClient with cache_keys=True serves potentially revoked keys #1051

Open
@nick4u

Description

@nick4u

PyJWKClient initialised with cache_keys=True decorates self.get_signing_key with lru_cache here

functools.lru_cache does not support cached item expiration natively and without it once cached/returned key for given kid will be served "forever".
I believe caching function should have TTL set to lifespan value and also entire cache should be flushed in case jwk_set_cache is updated.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions