Fix #1051: Replace lru_cache with TTL-based key caching by ArvinAlizadehGitHub · Pull Request #1070 · jpadilla/pyjwt

ArvinAlizadehGitHub · 2025-06-23T09:26:35Z

Summary

This PR fixes issue #1051 where PyJWKClient with cache_keys=True serves potentially revoked keys indefinitely.

Problem

When cache_keys=True is enabled, PyJWKClient applies @lru_cache to the get_signing_key method. This caches keys permanently until LRU eviction or process restart. If an identity provider removes a key from their JWKS, applications continue accepting tokens signed with that key.

Solution

Replace lru_cache with TTL-aware caching
Keys now expire after the configured lifespan (default 300 seconds)
Maintains full backward compatibility with existing API
Uses same expiration logic as existing JWKSetCache

Changes

jwt/jwks_client.py: Replace lru_cache with TTL cache implementation
tests/test_jwks_client.py: Add test demonstrating the fix works

Testing

All existing tests pass. New test verifies that:

Old implementation serves cached keys indefinitely
New implementation properly rejects expired keys

Backward Compatibility

No breaking changes. All existing parameters work identically:

cache_keys=True still enables individual key caching
max_cached_keys still limits cache size
Performance characteristics maintained

Fixes #1051

Copilot

Pull Request Overview

This PR fixes issue #1051 by replacing the permanent lru_cache with a TTL-aware cache for individual keys, ensuring that revoked keys are no longer served indefinitely.

Replaces lru_cache with a TTL-based caching mechanism in jwt/jwks_client.py.
Adds tests in tests/test_jwks_client.py to verify key expiration and proper cache eviction.
Updates the CHANGELOG to document the change.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/test_jwks_client.py	Adds new tests verifying that expired keys are rejected and cache eviction works correctly.
jwt/jwks_client.py	Refactors caching logic by adding TTL-based caching methods and removing lru_cache.
CHANGELOG.rst	Updates changelog to capture the new TTL-aware key caching fix.

Comments suppressed due to low confidence (1)

CHANGELOG.rst:12

The issue reference in the changelog appears to be inconsistent with the PR title (#1051). Please update the issue reference to #1051 if that is the correct identifier.

- Fix indefinite key caching in PyJWKClient by replacing lru_cache with TTL-aware cache in `#1070 <https://github.com/jpadilla/pyjwt/pull/1070>`__

ArvinAlizadehGitHub · 2025-07-07T08:21:11Z

Hi @auvipy (or @jpadilla)
The pre-commit checks are failing on an unrelated mypy error in jwt/algorithms.py line 796 (redundant type cast). This error exists in the main branch and is unrelated to my changes.

My changes only touch jwt/jwks_client.py and the test file. The failing mypy check is for code I didn't modify.

Could you advise if I should:

Fix the unrelated mypy error in algorithms.py, or
Have this merged as-is since it's a pre-existing issue?

The actual functionality tests are all passing - it's just the linting that's catching this pre-existing issue.

Would appreciate any feedback on next steps to move this forward. Happy to make any adjustments needed!

auvipy

please fix the merge conflicts

thomasuster · 2026-03-02T18:19:00Z

This is PR addresses a very important problem, looking forward to it's review/merge/release.

auvipy · 2026-03-29T13:04:02Z

there are merge conflicts to fix

thomasuster · 2026-04-24T17:23:15Z

@ArvinAlizadehGitHub

thomasuster · 2026-07-17T17:12:59Z

@auvipy Let's close this so someone else might consider making a PR to fix the issue.

ArvinAlizadehGitHub · 2026-07-17T17:15:36Z

@thomasuster @auvipy sorry ill take a look and get to fixing the errors

auvipy · 2026-07-18T16:23:24Z

@thomasuster @auvipy sorry ill take a look and get to fixing the errors

sure please

ArvinAlizadehGitHub · 2026-07-20T08:07:38Z

@thomasuster @auvipy should be updated to resolve conflicts and staleness, pls have a look / run workflows

for more information, see https://pre-commit.ci

ArvinAlizadehGitHub · 2026-07-23T06:23:04Z

@auvipy @thomasuster pls have a look and rerun the workflows thanks

thomasuster · 2026-08-06T20:34:17Z

@auvipy Are we good to go?

ArvinAlizadehGitHub · 2026-08-24T13:32:23Z

Hi @auvipy , any update on this PR? Thanks!

thomasuster · 2026-09-01T17:32:07Z

@jpadilla Are we good to go on this one?

auvipy · 2026-09-02T09:02:27Z

lets do another round of review

Copilot

🟡 Changes recommended

Cache invalidation, thread safety, capacity edge cases, and backward-compatible LRU behavior remain unresolved.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 3/3 changed files
Comments generated: 5
Review effort level: Balanced

+        if not self._key_cache_enabled or kid not in self._key_cache:
+            return None
+
+        key, timestamp = self._key_cache[kid]


+        cached_key = self._get_cached_key(kid)
+        if cached_key is not None:
+            return cached_key


+                str, tuple[PyJWK, float]
+            ] = {}  # kid -> (key, timestamp)
+            self._max_cached_keys = max_cached_keys
+            self._key_cache_ttl = lifespan  # Use same TTL as JWKSetCache


+        # Evict oldest if at capacity
+        if len(self._key_cache) >= self._max_cached_keys and kid not in self._key_cache:
+            # Simple eviction: remove oldest timestamp
+            oldest_kid = min(
+                self._key_cache.keys(), key=lambda k: self._key_cache[k][1]
+            )


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

ArvinAlizadehGitHub force-pushed the fix-lru-cache-security-vulnerability branch from 4eaa549 to 11b357a Compare June 23, 2025 09:32

ArvinAlizadehGitHub mentioned this pull request Jun 23, 2025

PyJWKClient with cache_keys=True serves potentially revoked keys #1051

Open

auvipy requested review from auvipy and Copilot and removed request for Copilot June 23, 2025 15:57

Copilot AI reviewed Jun 24, 2025

View reviewed changes

Comment thread tests/test_jwks_client.py Outdated

github-actions Bot added the stale Issues without activity for more than 60 days label Nov 6, 2025

github-actions Bot closed this Nov 13, 2025

auvipy reopened this Nov 13, 2025

github-actions Bot removed the stale Issues without activity for more than 60 days label Nov 14, 2025

auvipy requested changes Mar 2, 2026

View reviewed changes

coderabbitai Bot mentioned this pull request Jun 28, 2026

Refactor: Extract JWT validation logic to infrastructure layer YKDBontekoe/miru#827

Open

coderabbitai Bot mentioned this pull request Jul 8, 2026

FEAT: 리포트 목록 조회 기능 추가 2026-teecher-summer-team-E/CommercialRadar#19

Merged

ArvinAlizadehGitHub force-pushed the fix-lru-cache-security-vulnerability branch from a00aaff to b55a383 Compare July 20, 2026 08:02

Fix jpadilla#1051: Replace lru_cache with TTL-based key caching

465fe2b

ArvinAlizadehGitHub force-pushed the fix-lru-cache-security-vulnerability branch from 5808196 to 465fe2b Compare July 21, 2026 06:43

[pre-commit.ci] auto fixes from pre-commit.com hooks

15c90b0

for more information, see https://pre-commit.ci

ArvinAlizadehGitHub requested a review from auvipy July 23, 2026 06:41

coderabbitai Bot mentioned this pull request Aug 7, 2026

feat(auth): Apple 로그인 verifier 구현 — JWKS 서명 검증 CSE-Sudo/on-care#458

Merged

3 tasks

auvipy requested a balanced review from Copilot September 2, 2026 09:02

Copilot started reviewing on behalf of auvipy September 2, 2026 09:02 View session

Copilot AI reviewed Sep 2, 2026

View reviewed changes

Potential fix for pull request finding

1483eca

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

coderabbitai Bot mentioned this pull request Sep 21, 2026

feat(auth): validate official Keycloak token contract Ouros-App/ms-auth-service#6

Closed

Uh oh!

Conversation

ArvinAlizadehGitHub commented Jun 23, 2025

Summary

Problem

Solution

Changes

Testing

Backward Compatibility

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

ArvinAlizadehGitHub commented Jul 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

auvipy left a comment

Choose a reason for hiding this comment

Uh oh!

thomasuster commented Mar 2, 2026

Uh oh!

auvipy commented Mar 29, 2026

Uh oh!

thomasuster commented Apr 24, 2026

Uh oh!

thomasuster commented Jul 17, 2026

Uh oh!

ArvinAlizadehGitHub commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

auvipy commented Jul 18, 2026

Uh oh!

ArvinAlizadehGitHub commented Jul 20, 2026

Uh oh!

ArvinAlizadehGitHub commented Jul 23, 2026

Uh oh!

thomasuster commented Aug 6, 2026

Uh oh!

ArvinAlizadehGitHub commented Aug 24, 2026

Uh oh!

thomasuster commented Sep 1, 2026

Uh oh!

auvipy commented Sep 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ArvinAlizadehGitHub commented Jul 7, 2025 •

edited

Loading

ArvinAlizadehGitHub commented Jul 17, 2026 •

edited

Loading