Skip to content

[Bug]: Token validator fetches JWKS on every validation #344

@jerbob92

Description

@jerbob92

Bug Description

Currently, the Token validator creates a new jwt.PyJWKClient on every validation, causing the JWKS to be fetched on every validation. The jwt.PyJWKClient should be created on init of the TokenValidator and re-used very time so that it can use its internal caching mechanism.

See https://github.com/microsoft/teams.py/blob/main/packages/apps/src/microsoft_teams/apps/auth/token_validator.py#L113

And https://github.com/jpadilla/pyjwt/blob/master/jwt/jwks_client.py#L16 for the cache options.

Steps to Reproduce

  1. Send a message to the bot
  2. Bots validates token
  3. TokenValidator fetches JWKS on every request

Expected Behavior

That it caches the JWKS

Actual Behavior

No caching

SDK Version

2.0.0a20

Python Version

3.14.2

Additional Context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions