Re:JWT vs. Opaque Tokens
by mooreds on Thursday September 29, 2022 @12:15PM
(#33022745)
> In order to not have to care about rotating keys, a typical Resource Server would fetch the public key from the [authorization] server.
Another option would to be prepackage N public keys with the resource server during deployment. This means there is absolutely no network access required, just filesystem access to the public keys.
You want more than 1 so that you can rotate the signing keys if you need to, without redeploying said service.
What is the correct value for N? I dunno, depends, but it's not hard to generate 100 public/private keypairs and then bundle up the 100 public keys into a deployment artifact.
Is this as common as using JWKS? No, not in my experience. Is it possible? Absolutely.
Another option would to be prepackage N public keys with the resource server during deployment. This means there is absolutely no network access required, just filesystem access to the public keys.
You want more than 1 so that you can rotate the signing keys if you need to, without redeploying said service.
What is the correct value for N? I dunno, depends, but it's not hard to generate 100 public/private keypairs and then bundle up the 100 public keys into a deployment artifact.
Is this as common as using JWKS? No, not in my experience. Is it possible? Absolutely.