Support for JWKS public keys

[mcollina]

We should support fetching from a JWKS url and cache things.

#62 for the caching bit.

[simoneb]

I believe there's an implementation of support for JWKS specific to auth0 in https://github.com/nearform/fastify-auth0-verify.

We also probably want to have this feature integrated in https://github.com/fastify/fastify-jwt but the implementation should live in a standalone library so it can be used outside of fastify-jwt

[simoneb]

This is the AWS Cognito documentation about how to validate the JWTs it generates, which also uses JWKS. https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html

[p16]

To add more context to this issue:

• we need a separate package for jwks (not inside fast-jwt)
• fastify-auth0-verify and fastify-jwt would use that new package
• fast-jwt conceptually is like jsonwebtoken, but it's not reasonable to assume we can replace jsonwebtoken inside fastify-jwt: fast-jwt is not at that level yet.

The package should do

• fetch jwks
• having a way to return you the secret that matches kid and alg
• validate a jwt against that secret

[mcollina]

I would avoid:

validate a jwt against that secret

and leave it to jsonwebtoken and this module.

[p16]

What has been done up until now:

• We created the jwks-fetch repo and move there the feature discussed with @simoneb and @mcollina (from here)
• the jwks-fetch implementation should be addressing all the requests in this ticket (partially also Add a cache for async keys #62)

What is left to do:

• use jwks-fetch in fastify-auth0-verify
• use jwks-fetch in fast-jwt

[simoneb]

@conor909 let's do this first:

• use jwks-fetch in fast-jwt

Which requires that jwks-fetch is published to npm, CI is setup and so on

[mcollina]

The best approach would be:

const  {createVerifier} = require('fast-jwt')
const buildJwks = require('jwks-fetch')
const verify = createVerifier({ key: buildJwks() })

Essentially making the two modules loosely couple (but working well together).

[simoneb]

there is now a hint about how to do this via get-jwks here. It's not exactly the one liner you had in mind but it's not too bad either

[sameer-coder]

JWKS public keys are supported by get-jwks package. Please refer get-jwks docs for examples on integration with fast-jwt. Closing this issue.