Authentication using JWKUrl

[minhaj (Minhaj Shakeel)]

@michaelcompton

Yeah, but this does imply that we have to be able to validate the JWT with both the current key and the previous key.

Yeah, this will be done until the old key is revoked, All the newly minted tokens will be verified against the newly generated key.

@michaelcompton

Yeah, so I’d avoid having that if it’s so bespoke - at least in a first cut, if loads of users want more firebase support, then go for it, but in a first version, we need the max age in the settings to accomodate more cases, so don’t complicate things.

We can do the following:

1. Provide the max-age in settings so that the user can configure it at the time of submitting the schema.
2. Deal with the Response headers to specifically solve the problem for the firebase case (which a requested feature from some users)