Skip to content

Commit 5a49d71

Browse files
rthellendrthellend
committed
Refactor JWKS into its own module and update examples
1 parent 2238551 commit 5a49d71

File tree

12 files changed

+109
-382
lines changed

12 files changed

+109
-382
lines changed

‎examples/backend/backend.go‎

Lines changed: 25 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ package main
2626

2727
import (
2828
"context"
29-
"crypto/ecdsa"
3029
"crypto/tls"
3130
"flag"
3231
"fmt"
@@ -39,12 +38,12 @@ import (
3938
"os/signal"
4039
"strings"
4140
"syscall"
42-
"time"
4341

4442
"github.com/blend/go-sdk/envoyutil"
4543
"github.com/c2FmZQ/tlsproxy/certmanager"
44+
"github.com/c2FmZQ/tlsproxy/jwks"
4645
jwt "github.com/golang-jwt/jwt/v5"
47-
"github.com/lestrrat-go/jwx/jwk"
46+
"github.com/hashicorp/go-retryablehttp"
4847
"github.com/quic-go/quic-go/http3"
4948
)
5049

@@ -131,50 +130,46 @@ func main() {
131130

132131
type service struct {
133132
ctx context.Context
134-
ar *jwk.AutoRefresh
133+
remote *jwks.Remote
135134
jwksURL string
136135
}
137136

138137
func newService(ctx context.Context, jwksURL string, insecureSkipVerify bool) *service {
139-
ar := jwk.NewAutoRefresh(ctx)
140-
opts := []jwk.AutoRefreshOption{
141-
jwk.WithRefreshInterval(60 * time.Minute),
142-
}
143-
if insecureSkipVerify {
144-
opts = append(opts, jwk.WithHTTPClient(&http.Client{
145-
Transport: &http.Transport{
146-
TLSClientConfig: &tls.Config{
147-
InsecureSkipVerify: true,
148-
},
138+
client := retryablehttp.NewClient()
139+
client.HTTPClient = &http.Client{
140+
Transport: &http.Transport{
141+
TLSClientConfig: &tls.Config{
142+
InsecureSkipVerify: insecureSkipVerify,
149143
},
150-
}))
144+
},
151145
}
152-
ar.Configure(jwksURL, opts...)
146+
client.Logger = nil
147+
148+
remote := jwks.NewRemote(client, nil)
149+
remote.SetIssuers([]jwks.Issuer{
150+
{
151+
Issuer: "https://login.example.com", // This needs to match the issuer in the token
152+
JWKSURI: jwksURL,
153+
},
154+
})
155+
go func() {
156+
<-ctx.Done()
157+
remote.Stop()
158+
}()
159+
153160
return &service{
154161
ctx: ctx,
155-
ar: ar,
162+
remote: remote,
156163
jwksURL: jwksURL,
157164
}
158165
}
159166

160167
func (s *service) getKey(token *jwt.Token) (interface{}, error) {
161-
set, err := s.ar.Fetch(s.ctx, s.jwksURL)
162-
if err != nil {
163-
return nil, err
164-
}
165168
kid, ok := token.Header["kid"].(string)
166169
if !ok {
167170
return nil, fmt.Errorf("kid is %T", token.Header["kid"])
168171
}
169-
if key, ok := set.LookupKeyID(kid); ok {
170-
var pubKey ecdsa.PublicKey
171-
if err := key.Raw(&pubKey); err != nil {
172-
return nil, err
173-
}
174-
return &pubKey, nil
175-
}
176-
177-
return nil, fmt.Errorf("%s not found", kid)
172+
return s.remote.GetKey(kid)
178173
}
179174

180175
func (s *service) ServeHTTP(w http.ResponseWriter, req *http.Request) {

‎examples/backend/go.mod‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,15 @@ go 1.25.5
55
require (
66
github.com/blend/go-sdk v1.20240719.1
77
github.com/c2FmZQ/tlsproxy v0.24.2
8+
github.com/c2FmZQ/tlsproxy/jwks v0.0.0-20260130170702-223855195ae7
89
github.com/golang-jwt/jwt/v5 v5.3.1
9-
github.com/lestrrat-go/jwx v1.2.31
10+
github.com/hashicorp/go-retryablehttp v0.7.8
1011
github.com/quic-go/quic-go v0.59.0
1112
)
1213

1314
require (
14-
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
15-
github.com/goccy/go-json v0.10.5 // indirect
1615
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
17-
github.com/lestrrat-go/backoff/v2 v2.0.8 // indirect
18-
github.com/lestrrat-go/blackmagic v1.0.4 // indirect
19-
github.com/lestrrat-go/httpcc v1.0.1 // indirect
20-
github.com/lestrrat-go/iter v1.0.2 // indirect
21-
github.com/lestrrat-go/option v1.0.1 // indirect
22-
github.com/pkg/errors v0.9.1 // indirect
16+
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
2317
github.com/quic-go/qpack v0.6.0 // indirect
2418
golang.org/x/crypto v0.47.0 // indirect
2519
golang.org/x/net v0.49.0 // indirect

‎examples/backend/go.sum‎

Lines changed: 14 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -2,36 +2,30 @@ github.com/blend/go-sdk v1.20240719.1 h1:eyispDP9DzQuNE+y7j1xSqwRm6ndMS4jgwlOQU4
22
github.com/blend/go-sdk v1.20240719.1/go.mod h1:aTw/exIbMHDYcJLTiqeWMMVhUs9+72BDe26AA0A6jno=
33
github.com/c2FmZQ/tlsproxy v0.24.2 h1:uK8Dy4u0R6t+lgVphdHXFrivs2Q+PYwp1/GN8vvh7Sg=
44
github.com/c2FmZQ/tlsproxy v0.24.2/go.mod h1:MWZUQ+DEhYO766iQHe/OtnfovDFGwdEoLCzFF4VF+Xs=
5-
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5+
github.com/c2FmZQ/tlsproxy/jwks v0.0.0-20260130170702-223855195ae7 h1:X9sQsvaKIg79vUJ6ER/isN5fDkuEoWsBnEHYm4Z/WF4=
6+
github.com/c2FmZQ/tlsproxy/jwks v0.0.0-20260130170702-223855195ae7/go.mod h1:OmTz0Nc+C8Ent4TvkXv+0zQGdvMFHU/6ZTon629wjOk=
67
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
78
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
8-
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
9-
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
10-
github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
11-
github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
9+
github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
10+
github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
1211
github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
1312
github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
1413
github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
1514
github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
15+
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
16+
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
17+
github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
18+
github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
19+
github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
20+
github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
1621
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
1722
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
1823
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
1924
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
20-
github.com/lestrrat-go/backoff/v2 v2.0.8 h1:oNb5E5isby2kiro9AgdHLv5N5tint1AnDVVf2E2un5A=
21-
github.com/lestrrat-go/backoff/v2 v2.0.8/go.mod h1:rHP/q/r9aT27n24JQLa7JhSQZCKBBOiM/uP402WwN8Y=
22-
github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA=
23-
github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw=
24-
github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
25-
github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
26-
github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
27-
github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
28-
github.com/lestrrat-go/jwx v1.2.31 h1:/OM9oNl/fzyldpv5HKZ9m7bTywa7COUfg8gujd9nJ54=
29-
github.com/lestrrat-go/jwx v1.2.31/go.mod h1:eQJKoRwWcLg4PfD5CFA5gIZGxhPgoPYq9pZISdxLf0c=
30-
github.com/lestrrat-go/option v1.0.0/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
31-
github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
32-
github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
33-
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
34-
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
25+
github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
26+
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
27+
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
28+
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
3529
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
3630
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
3731
github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
@@ -40,9 +34,6 @@ github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SA
4034
github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
4135
github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
4236
github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
43-
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
44-
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
45-
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
4637
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
4738
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
4839
go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
@@ -58,6 +49,5 @@ golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
5849
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5950
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
6051
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
61-
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
6252
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
6353
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

‎examples/oauth2server/go.mod‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,15 @@
11
module github.com/c2FmZQ/tlsproxy/example/oauth2server
22

3-
go 1.24.6
3+
go 1.25.5
44

55
require (
6+
github.com/c2FmZQ/tlsproxy/jwks v0.0.0-20260130170702-223855195ae7
67
github.com/golang-jwt/jwt/v5 v5.3.1
7-
github.com/lestrrat-go/httprc/v3 v3.0.3
8-
github.com/lestrrat-go/jwx/v3 v3.0.13
98
golang.org/x/oauth2 v0.34.0
109
)
1110

1211
require (
13-
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
14-
github.com/goccy/go-json v0.10.5 // indirect
15-
github.com/lestrrat-go/blackmagic v1.0.4 // indirect
16-
github.com/lestrrat-go/httpcc v1.0.1 // indirect
17-
github.com/lestrrat-go/option/v2 v2.0.0 // indirect
18-
github.com/segmentio/asm v1.2.1 // indirect
12+
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
13+
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
1914
golang.org/x/sys v0.40.0 // indirect
2015
)

‎examples/oauth2server/go.sum‎

Lines changed: 14 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,20 @@
1-
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
2-
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
3-
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
4-
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
5-
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
6-
github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
7-
github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
1+
github.com/c2FmZQ/tlsproxy/jwks v0.0.0-20260130170702-223855195ae7 h1:X9sQsvaKIg79vUJ6ER/isN5fDkuEoWsBnEHYm4Z/WF4=
2+
github.com/c2FmZQ/tlsproxy/jwks v0.0.0-20260130170702-223855195ae7/go.mod h1:OmTz0Nc+C8Ent4TvkXv+0zQGdvMFHU/6ZTon629wjOk=
3+
github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
4+
github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
85
github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
96
github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
10-
github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA=
11-
github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw=
12-
github.com/lestrrat-go/dsig v1.0.0 h1:OE09s2r9Z81kxzJYRn07TFM9XA4akrUdoMwr0L8xj38=
13-
github.com/lestrrat-go/dsig v1.0.0/go.mod h1:dEgoOYYEJvW6XGbLasr8TFcAxoWrKlbQvmJgCR0qkDo=
14-
github.com/lestrrat-go/dsig-secp256k1 v1.0.0 h1:JpDe4Aybfl0soBvoVwjqDbp+9S1Y2OM7gcrVVMFPOzY=
15-
github.com/lestrrat-go/dsig-secp256k1 v1.0.0/go.mod h1:CxUgAhssb8FToqbL8NjSPoGQlnO4w3LG1P0qPWQm/NU=
16-
github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
17-
github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
18-
github.com/lestrrat-go/httprc/v3 v3.0.3 h1:WjLHWkDkgWXeIUrKi/7lS/sGq2DjkSAwdTbH5RHXAKs=
19-
github.com/lestrrat-go/httprc/v3 v3.0.3/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0=
20-
github.com/lestrrat-go/jwx/v3 v3.0.13 h1:AdHKiPIYeCSnOJtvdpipPg/0SuFh9rdkN+HF3O0VdSk=
21-
github.com/lestrrat-go/jwx/v3 v3.0.13/go.mod h1:2m0PV1A9tM4b/jVLMx8rh6rBl7F6WGb3EG2hufN9OQU=
22-
github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=
23-
github.com/lestrrat-go/option/v2 v2.0.0/go.mod h1:oSySsmzMoR0iRzCDCaUfsCzxQHUEuhOViQObyy7S6Vg=
24-
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
25-
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
26-
github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0=
27-
github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
28-
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
29-
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
30-
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
31-
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
32-
github.com/valyala/fastjson v1.6.7 h1:ZE4tRy0CIkh+qDc5McjatheGX2czdn8slQjomexVpBM=
33-
github.com/valyala/fastjson v1.6.7/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY=
34-
golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
35-
golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
7+
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
8+
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
9+
github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
10+
github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
11+
github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
12+
github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
13+
github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
14+
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
15+
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
16+
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
3617
golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
3718
golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
3819
golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
3920
golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
40-
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
41-
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
42-
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
43-
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

‎examples/oauth2server/oauth2server.go‎

Lines changed: 17 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,8 @@ import (
1717
"strings"
1818
"time"
1919

20+
"github.com/c2FmZQ/tlsproxy/jwks"
2021
jwt "github.com/golang-jwt/jwt/v5"
21-
"github.com/lestrrat-go/httprc/v3"
22-
"github.com/lestrrat-go/jwx/v3/jwk"
2322
"golang.org/x/oauth2"
2423
)
2524

@@ -97,26 +96,32 @@ type Server struct {
9796
UserinfoEndpoint string `json:"userinfo_endpoint"`
9897
JWKSURI string `json:"jwks_uri"`
9998
}
100-
jwkCache *jwk.Cache
99+
remote *jwks.Remote
101100
}
102101

103102
func (s *Server) Run(ctx context.Context) error {
104103
s.ctx = ctx
105104
resp, err := http.Get(s.OpenIDConfigURL)
106105
if err != nil {
107-
return fmt.Errorf("%s: %w", s.OpenIDConfigURL)
106+
return fmt.Errorf("%s: %w", s.OpenIDConfigURL, err)
108107
}
109108
defer resp.Body.Close()
110109
if err := json.NewDecoder(resp.Body).Decode(&s.openIDConfig); err != nil {
111-
return fmt.Errorf("openid config: %w", s.OpenIDConfigURL)
112-
}
113-
if s.jwkCache, err = jwk.NewCache(ctx, httprc.NewClient()); err != nil {
114-
return fmt.Errorf("jwk.NewCache: %w", err)
115-
}
116-
if err := s.jwkCache.Register(ctx, s.openIDConfig.JWKSURI); err != nil {
117-
return fmt.Errorf("jwkCache.Register: %w", err)
110+
return fmt.Errorf("openid config: %w", err)
118111
}
119112

113+
s.remote = jwks.NewRemote(nil, nil)
114+
s.remote.SetIssuers([]jwks.Issuer{
115+
{
116+
Issuer: "https://login.example.com", // This needs to match the issuer in the token
117+
JWKSURI: s.openIDConfig.JWKSURI,
118+
},
119+
})
120+
go func() {
121+
<-ctx.Done()
122+
s.remote.Stop()
123+
}()
124+
120125
mux := http.NewServeMux()
121126
mux.HandleFunc("GET /{$}", func(w http.ResponseWriter, req *http.Request) {
122127
log.Printf("%s %s", req.Method, req.RequestURI)
@@ -226,17 +231,5 @@ func (s *Server) getKey(token *jwt.Token) (interface{}, error) {
226231
if !ok {
227232
return nil, fmt.Errorf("kid is %T", token.Header["kid"])
228233
}
229-
keySet, err := s.jwkCache.Lookup(s.ctx, s.openIDConfig.JWKSURI)
230-
if err != nil {
231-
return nil, fmt.Errorf("%s: %v", s.openIDConfig.JWKSURI)
232-
}
233-
key, ok := keySet.LookupKeyID(kid)
234-
if !ok {
235-
return nil, fmt.Errorf("%s not found", kid)
236-
}
237-
var pub any
238-
if err := jwk.Export(key, &pub); err != nil {
239-
return nil, err
240-
}
241-
return pub, nil
234+
return s.remote.GetKey(kid)
242235
}

‎go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ require (
1010
github.com/c2FmZQ/http3-go v0.59.0
1111
github.com/c2FmZQ/quic-api v0.59.0
1212
github.com/c2FmZQ/storage v0.3.2
13+
github.com/c2FmZQ/tlsproxy/jwks v0.0.0-20260130170702-223855195ae7
1314
github.com/c2FmZQ/tpm v0.4.3
1415
github.com/fxamacker/cbor/v2 v2.9.0
1516
github.com/go-test/deep v1.1.0

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ github.com/c2FmZQ/quic-api v0.59.0 h1:bLq5g0hX60Uy/SuDhplq07jTun/9GMe28oXLemW54x
1212
github.com/c2FmZQ/quic-api v0.59.0/go.mod h1:eo7AOXIR//Pf2pfQ+rP18fQTjwyIPPp3cBopMNr/NTU=
1313
github.com/c2FmZQ/storage v0.3.2 h1:/Qy/uoZTEw1XxrkHK4MAiQliwpZ02Y5w/whym8Q4+qQ=
1414
github.com/c2FmZQ/storage v0.3.2/go.mod h1:kgLL2yKcpWW62FmdoWwETSAWKpF95dBfhD6N7zfE1PE=
15+
github.com/c2FmZQ/tlsproxy/jwks v0.0.0-20260130170702-223855195ae7 h1:X9sQsvaKIg79vUJ6ER/isN5fDkuEoWsBnEHYm4Z/WF4=
16+
github.com/c2FmZQ/tlsproxy/jwks v0.0.0-20260130170702-223855195ae7/go.mod h1:OmTz0Nc+C8Ent4TvkXv+0zQGdvMFHU/6ZTon629wjOk=
1517
github.com/c2FmZQ/tpm v0.4.3 h1:b5jjlqVyf5rdU0z0uohi5QylE6hb6vxryWGr3b3qCos=
1618
github.com/c2FmZQ/tpm v0.4.3/go.mod h1:WOLrMYIX1ueasQqAdWcBjCwAJ+blrHEUxUcT1K0w360=
1719
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=

0 commit comments

Comments
 (0)