chubbyphp / chubbyphp-oidc / 33896839605

100%

push

github

bound the stale jwks window with maxStale (default: one hour)

A jwks outage kept serving the last known keys for as long as it lasted,
so a key the issuer removed in the meantime (e.g. a compromised one)
stayed valid indefinitely. RemoteJwkSet now takes maxStale: after maxAge
+ maxStale since the last successful fetch a failing refetch throws the
last jwks error instead, 0 never serves a stale jwks, null keeps the
previous unbounded behaviour. The laminas factory reads it from
chubbyphp.oidc.jwksMaxStale.

12 of 12 new or added lines in 2 files covered. (100.0%)

362 of 362 relevant lines covered (100.0%)

94.67 hits per line