Web Security · Senior · Question 34 of 75

How are JWT signing keys rotated without logging everyone out?

1Store keys in the token so the server doesn't need them
2Change the key and restart all servers at the same moment
✓Correct answer: Publish keys in a JWKS with kid values; sign with the new key while still accepting the old one until its tokens expire

Explanation

Verifiers look up the key by kid from a trusted JWKS URL. Never fetch keys from a URL given inside the token (jku) without strict checks.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.