Skip to content

PyJWKClient with cache_keys=True serves potentially revoked keys #1051

Open
@nick4u

Description

@nick4u

PyJWKClient initialised with cache_keys=True decorates self.get_signing_key with lru_cache here

functools.lru_cache does not support cached item expiration natively and without it once cached/returned key for given kid will be served "forever".
I believe caching function should have TTL set to lifespan value and also entire cache should be flushed in case jwk_set_cache is updated.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions