Ruben FiszelandClaude Opus 4.8 e1b74c7d1a fix: fail closed on JWKS keys past an absolute stale window ...

Stale-while-revalidate re-served cached keys and bumped their window on every
request, but never tracked when the keys were last fetched successfully, so a
persistently failing refresh (a revoked kid, or an unreachable issuer) served
the old keys forever, minting fresh 24h guest JWTs indefinitely. Track
fetched_at, preserve it across stale re-serves, and stop serving keys older than
JWKS_MAX_STALE (1h): too-old keys fall through to a blocking refresh that fails
closed. Also log the oversized-bearer refusal, which returned a bare None.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

2026-09-04 17:35:17 +02:00

..

src

fix: fail closed on JWKS keys past an absolute stale window

2026-09-04 17:35:17 +02:00

Cargo.toml

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00