Social Sign-In JWT Verification: Surviving Key Rotation Without Authentication Outages

A media service that authenticates users via Google and GitHub accounts faces the challenge of maintaining account accessibility when the signing key used to validate JWT tokens is rotated. The solution is to refresh the JSON Web Key Set (JWKS) from the issuer's server, which contains the current public keys used to verify tokens, when a verification attempt encounters an unknown key ID.

The service should perform this refresh once under a rate limit, rather than waiting for a scheduled cache timer, to ensure a swift authentication recovery. The last successful set of keys should be retained during the refresh process, and any token that uses a key not present in the refreshed set should be rejected. An audit event should be recorded to differentiate between a cache miss and an invalid token signature.

This approach ensures an exactly-once refresh process, preventing multiple attempts that could lead to an authentication outage. A timer can still be used for background maintenance, but it should not be relied upon to prevent failures. The appearance of an unknown key ID after a key rotation indicates that the token is valid and the verification process should succeed.