Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →To keep OpenID Connect social sign-in working through signing-key rotation, cache the issuer’s published public keys, refresh the configured JWKS endpoint when a token presents an unfamiliar kid, and retry verification. During a temporary JWKS outage, a cached key may still verify a token signed with that key. If no eligible cached key matches, reject the token rather than accepting an unverifiable login. Rotation should publish a new public key before it is used and retain the retiring key during a provider-appropriate transition period.
How ID-token key discovery works
An OpenID Connect relying party should begin with a trusted, configured issuer. The issuer’s discovery metadata advertises a jwks_uri, where the verifier obtains the issuer’s JSON Web Key Set (JWKS). A JWKS may contain multiple public keys. The JWT header’s kid identifies which candidate key to use; it is a lookup hint, not proof that the token is valid. OpenID Connect Core describes retrieving fresh keys when the verifier sees an unfamiliar kid (OpenID Connect Core 1.0).
As an Amazon Associate I earn from qualifying purchases.
Use discovery and JWKS URLs associated with the trusted issuer, obtained over HTTPS. Do not choose a key endpoint from an untrusted token header: JWT Best Current Practice warns against blindly following token-provided jku or x5u values (IETF RFC 8725).
What the verifier should do for each token
On a cache hit
Keep the issuer’s keys or parsed public keys in a cache indexed by kid. Use an eligible matching key to verify the signature, then run the full ID-token validation profile for the provider and client. Do not fetch the JWKS for every token. AWS Cognito documents caching keys by kid and refreshing when a correctly issued token uses a different key (AWS Cognito token verification guidance).
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Respect the issuer’s HTTP Cache-Control guidance and set a periodic refresh policy appropriate to the deployment. Cache duration is not universal: it must work with the provider’s published guidance and key-removal behavior.
On an unfamiliar kid
- Make a bounded refresh request to the configured issuer’s
jwks_uri; do not use a URL supplied by the token. - Validate the JWKS response before replacing or updating the cache. Index eligible keys by their
kid. - Retry key selection and signature verification with the refreshed set. If the key is still absent, reject the token.
Coalesce simultaneous cache misses into one refresh, and briefly suppress repeated refreshes for the same still-unknown key. These are practical safeguards against request storms, not a shared algorithm mandated by the cited provider documentation. Treat kid as untrusted input, particularly if it is used in a database or directory lookup.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
When the JWKS endpoint is unavailable
A temporary fetch failure does not invalidate a key already in cache. If a cached, eligible key matches the token and the signature and all required claims validate, verification can proceed. GOV.UK One Login explicitly recommends continuing to trust its cached JWKS until refresh is available (GOV.UK One Login integration guidance).
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11A stale cache cannot verify a token signed with a new, unknown key. If no cached key matches, or a successful refresh still lacks the requested key, fail verification. Keep the failure bounded and observable, and offer a retry or another supported sign-in option rather than creating a fail-open login path.
Rank #3
| Condition | Safe verifier action |
|---|---|
| Cached eligible key matches; signature and profile checks pass | Accept only after all validation checks succeed; no per-token JWKS download is needed. |
Unknown kid; refresh succeeds and supplies an eligible key |
Retry verification with the updated cache, then perform all normal token checks. |
| JWKS refresh fails; cached eligible key matches | Verify with the cached key if signature and profile checks pass. |
| No cached match, or refresh succeeds but still has no match | Reject the token; report a recoverable verification failure. |
| Matching key exists but signature or claims fail | Reject; key selection alone does not establish token validity. |
How issuers can rotate keys without breaking verifiers
A routine handoff needs an overlap, not a simultaneous swap. OpenID Connect Core recommends retaining recently decommissioned keys for a reasonable period; NHS England Digital describes publishing a replacement public key before using its private counterpart (OpenID Connect Core 1.0; NHS England Digital key management guidance).
- Generate a replacement signing key and publish its public JWK with a unique
kid. - Allow verifiers’ caches time to observe the new key, following cache directives and partner integration agreements.
- Begin signing with the replacement private key and include its matching
kid. - Keep the previous public key published for a transition period so cached verifiers and still-valid tokens can complete the handoff.
- Remove the retiring public key when the overlap ends. For a compromised key, follow the provider’s revocation process; urgent revocation may deliberately take precedence over seamless availability.
There is no universal overlap duration. It depends on token lifetime, the longest legitimate cache lifetime, deployment propagation, and the issuer’s removal policy. Provider calendars are examples, not general rules: Login.gov says its public verification key rotates periodically, at least annually (Login.gov OIDC certificates, page reviewed 4 September 2026). GOV.UK One Login documents production rotations every six months beginning the week commencing 30 March 2026, while noting that short-notice rotation can occur (GOV.UK One Login integration guidance, accessed 5 October 2026).
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Rotation must not weaken token validation
Refreshing keys answers only which public key may verify a signature. It does not make the token trustworthy by itself. Keep the provider’s complete ID-token validation profile in place:
Recommended Free Tools
- Specify an explicit allowlist of accepted signing algorithms, and use each key only for its intended algorithm. RFC 8725 says verifiers must not accept algorithms outside the caller’s supported set (IETF RFC 8725).
- Bind keys to the configured trusted issuer and validate the token’s
iss. - Validate
audfor the intended client; reject tokens meant for another relying party. - Check time claims and provider-required checks such as
nonce, according to the applicable OpenID Connect profile (OpenID Connect Core 1.0). - Do not treat a successful key lookup as a substitute for verifying the signature and claims.
Diagnose the failure by its actual condition
Separate these cases in monitoring and incident handling: an unfamiliar key in the local cache, an unavailable JWKS endpoint, a successful refresh that still lacks the key, and a signature or claim failure with a matching key. They point to different causes—ordinary rotation or stale cache, provider/network availability, issuer/cache mismatch, or an invalid token/profile mismatch.
Best Value
Useful low-risk telemetry includes the configured issuer identifier, kid, cache age, refresh result and latency, JWKS HTTP status, key-selection result, and validation-failure category. Do not log the full token, secrets, or personal claims. During investigation, check the issuer’s live discovery metadata and current integration guidance because cache periods and key-removal behavior differ by provider.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
