Output of exportJWK cannot be used directly with createLocalJWKSet?

[chadjaros]

I'm getting the following error when I try to generate a new key pair and set it up in a JWKS.

JOSENotSupported: Unsupported "alg" value for a JSON Web Key Set

async function run() {
  const x = await jose.generateKeyPair('RS256', {extractable: true});
  console.log(x.publicKey);
  console.log(x.privateKey);

  const ujwk = await jose.exportJWK(x.publicKey);
  console.log('public', ujwk);
  const pjwk = await jose.exportJWK(x.privateKey);
  console.log('private', pjwk);

  const y = await jose.createLocalJWKSet({keys: [ujwk]})();

  console.log(x)

}

I notice that the output of exportJWK do not even have an alg property, which doesn't seem like it is is actually complying with RFC 7517 for a JWK. Is this expected?

Node version 20.5.0
Mac OS 14.7.1

[panva]

Output of exportJWK cannot be used directly with createLocalJWKSet?

Sure it can, it just needs to be used correctly as if you were passing it as a resolvekey function to a verifier that, when invoked, gets a parsed JOSE Header as its first argument based on which the key is selected from the set.

await jose.createLocalJWKSet(jwks)({ alg: 'RS256' });

I notice that the output of exportJWK do not even have an alg property, which doesn't seem like it is is actually complying with RFC 7517 for a JWK. Is this expected?

Use of this member is OPTIONAL, given the inconsistencies between runtimes it's better for consistency to strip it. You can always add the property yourself.

[chadjaros]

I see. So createLocalJWKSet is really just intended to support validating a token against a set of keys, and nothing more. And I was misusing the method by trying to call the resulting function object without the proper arguments.

Will the lack of certain properties on the JWK, kid for example, make signing and validating tokens less efficient if I have multiple JWKs in a set?

[panva]

I see. So createLocalJWKSet is really just intended to support validating a token against a set of keys, and nothing more. And I was misusing the method by trying to call the resulting function object without the proper arguments.

Correct.

Will the lack of certain properties on the JWK, kid for example, make signing and validating tokens less efficient if I have multiple JWKs in a set?

See v6.x/docs/jwks/local/functions/createLocalJWKSet.md

Only a single public key must match the selection process. As shown in the example below when multiple keys get matched it is possible to opt-in to iterate over the matched keys and attempt verification in an iterative manner.

[chadjaros]

Right - that example makes it seem like the lack of a kid not only requires more code, but it will also be a less efficient process. Iteratively validating every matching entry within a keyset containing 1000 potential matches will not be as fast as finding a match by kid.

I think it would be valuable to have documentation that explains the modifications you could/should make to the output of the exportJWK call and the impact they have on the behaviors of key signing and validation.

[panva]

I believe the implications of having multiple matched keys are pretty self-explanatory.

As a JWKS-issuer you ought to know how to both include scope-narrowing header parameters in your tokens as well as their counterpart in a JSON Web Key Set.

How this should intersect with exportJWK is unclear to me as the key object representations don't have an ID in the first place.

[panva]

And none of this has any interaction with signing since for the sign operations you must provide a single key.