PyJWKClient with `cache_keys=True` serves potentially revoked keys

[nick4u]

PyJWKClient initialised with cache_keys=True decorates self.get_signing_key with lru_cache here

functools.lru_cache does not support cached item expiration natively and without it once cached/returned key for given kid will be served "forever".
I believe caching function should have TTL set to lifespan value and also entire cache should be flushed in case jwk_set_cache is updated.

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days

[slimkhaliff]

Remove stale label On Friday, May 23, 2025, 9:06 PM, github-actions[bot] ***@***.***> wrote: github-actions[bot] left a comment (jpadilla/pyjwt#1051) This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[ArvinAlizadehGitHub]

Hi,

I wrote a small mock test to verify that it can serve revoked keys. Thereafter I implemented a suggestion on a fix and added a test to verify the fix works (and conversely, if we use the lru_cache the test fails)

The PR is here: #1070

Open to suggestions on how else to do it.

If anyone has time to review it would be great.