v2 and JWKS provider with extra params :/

[jh125486]

My JWKS provider requires the KID as URL query params, e.g.
kid: DEV_ASYMMETRIC_RSA_KEY_TEST_010^4
URL: https://my.jwks.provider/keys.json?kid=DEV_ASYMMETRIC_RSA_KEY_TEST_010^4

I'm having trouble figuring out how to use the new v2 code to do this and wanted to see if anyone else has come across this problem using jwk.NewCache.

[lestrrat]

@jh125486

In theory, you should be able to use the jwk.Fetch and jwk.Cache object even if there are query parameters in the URL (I don't remember stripping out query parameters). Is your question more on "I don't understand how to use this jwk.Cache thing" or "jwk.Cache is behaving incorrectly when presented with a URL with query parameters?"

[jh125486]

Sorry this took so very long to reply... I got side tracked to other projects and I finally got time to circle back to this.

So after hacking at this for a bit, this is what I have come up with....

1. jws.Parse raw token string
2. get KID from msg
3. check/get JWKSets from Cache
4. jwt.Parse with JWKSets

Anything look out of place?
I'm not 100% on how I've implemented the cache, since each Key has it's own URL/JWKSet to fetch.

func Middleware(svcctx context.Context) func(http.Handler) http.Handler {
	// create hash cache
	cache := jwk.NewCache(svcctx)
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			// naive token grab for example purposes
			bearer := r.Header.Get("Authorization")[7:]
			
                         // parse the JWS to get the KID
			msg, err := jws.ParseString(bearer)
			if err != nil {
				return // parse failure -> error out
			}

			// get kid from the JWS header
			kid := msg.Signatures()[0].ProtectedHeaders().KeyID()

			// get JWKS url from KID
			u := jwksURL(kid)

			// register URL if not registered in cache
			if cache.IsRegistered(u) {
				if err := cache.Register(u); err != nil {
					return // set an error in the context and error out later
				}
			}

			// get JWKSets from cache
			set, err := cache.Get(r.Context(), u)
			if err != nil {
				return // cache failure, error out
			}

			// parse token from bearer string and verify with set from cache
			token, err := jwt.ParseString(bearer, jwt.WithKeySet(set))
			if err != nil {
				return // parse, or possibly a verification error
			}
			
			// create a new context with the parsed & verified token
			ctx := context.WithValue(r.Context(), "tokenKey", token)

			// set the token in the next handler
			next.ServeHTTP(w, r.WithContext(ctx))
		})
	}
}

[lestrrat]

I'm sorry, I don't follow: what is the question? Are you getting any errors or unexpected behaviors?