Authentication using JWKUrl

[michaelcompton]

@minhaj

The decoded JWT token contains kid in its header in the case and we need to verify it against the signing key with the same kid from the fetched list of JWK’s.

Ah, looks like I missed a trick in my thing.

@minhaj

Any JWT which was signed by the previous key is still valid (as we have one of the JWK with exact same kid as in the decoded JWK)

Yeah, but this does imply that we have to be able to validate the JWT with both the current key and the previous key.

@minhaj

Both of these processes need to be incorporated

@minhaj

Parsing max-age from the response works only for firebase (as per my understanding).

Yeah, so I’d avoid having that if it’s so bespoke - at least in a first cut, if loads of users want more firebase support, then go for it, but in a first version, we need the max age in the settings to accomodate more cases, so don’t complicate things.