Skip to content

Conversation

wuhaoyujerry
Copy link
Owner

@wuhaoyujerry wuhaoyujerry commented Jul 1, 2022

Problem

The current PyJWT library only support caching of single signing key. Ref to jpadilla#611

Even though it avoid the network call when the services periodically calling get_signing_key with same kid, the current implementation doesn't have any TTL so the cache is stored forever. Also it still makes network call when different kid is provided.

Solution & Implantation

  • Add JWKSetCache object that stores jwk set with current timestamp
    • When user try to get signing key from jwk set, the service will try to check if the cache exist and not expired. If so, it will avoid the network call and return the cached jwk set.
    • If the network call throws any error, clear the cache.
    • If the service can't find matching kid from cached jwk set, it will make a new network call to get new jwk set and check again in new set
    • Add option to enable/disable jwk set cache and lifespan. Default lifespan is 5 minutes.
  • Add unit tests to cover the added code
  • Disable LRU cache for get_signing_key by default as suggested from this comment Cache signing keys jpadilla/pyjwt#611 (comment)

@wuhaoyujerry wuhaoyujerry merged commit 9ad63c2 into master Jul 11, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants