https://sauvikbiswas.com/tags/jwks/ Recent content in Jwks on Sauvik Biswas Hugo en-us Mon, 22 Jun 2026 00:00:00 +0000 https://sauvikbiswas.com/posts/learning-oauth-2-08/ Mon, 22 Jun 2026 00:00:00 +0000 https://sauvikbiswas.com/posts/learning-oauth-2-08/ <h2 class="heading" id="why-verify-only-apps-shouldnt-hold-the-signing-key"> Why verify-only apps shouldn&rsquo;t hold the signing key <a class="anchor" href="#why-verify-only-apps-shouldnt-hold-the-signing-key">#</a> </h2> <p><a href="https://sauvikbiswas.com/posts/learning-oauth-2-07/">v07</a> added OpenID Connect on top of v06&rsquo;s split architecture. The <code>id_token</code> is a signed JWT. Mode B access tokens are JWTs too. Both used HS256 with a shared <code>JWT_SECRET</code> copied into three <code>.env</code> files.</p> <p>That worked in a toy lab. It is not how production IdPs ship.</p> <table> <thead> <tr> <th>Concern</th> <th>v07 (HS256 + <code>JWT_SECRET</code>)</th> <th>v08 (RS256 + JWKS)</th> </tr> </thead> <tbody> <tr> <td>Who can <em>sign</em> tokens?</td> <td>Any process with <code>JWT_SECRET</code></td> <td>Only the auth server (private key)</td> </tr> <tr> <td>Who can <em>verify</em> tokens?</td> <td>Any process with <code>JWT_SECRET</code></td> <td>Anyone with the public key from <code>jwks_uri</code></td> </tr> <tr> <td>Key rotation</td> <td>Re-sync <code>JWT_SECRET</code> everywhere</td> <td>Publish new key in JWKS; verifiers pick by <code>kid</code></td> </tr> <tr> <td>Discovery</td> <td><code>id_token_signing_alg_values_supported: [&quot;HS256&quot;]</code></td> <td><code>[&quot;RS256&quot;]</code> + <code>jwks_uri</code></td> </tr> <tr> <td>Real IdPs (Google, Okta, Auth0)</td> <td>Not available (no shared secret)</td> <td>RS256; public keys at <code>jwks_uri</code> in discovery</td> </tr> </tbody> </table> <h3 class="heading" id="what-hs256-actually-means"> What HS256 actually means <a class="anchor" href="#what-hs256-actually-means">#</a> </h3> <p>HS256 is symmetric: one secret signs and verifies. In v07, the client verified <code>id_token</code> with <code>JWT_SECRET</code> and the resource server verified Mode B access tokens with the same secret while the auth server signed with it.</p>