v26.4.13
v26.4.13
Stricter requirements for client key sets at jwks_uri
Ory now accepts a key set downloaded from a client's jwks_uri only if it contains public keys only, is served from the origin of
jwks_uri, is at most 256 KiB, and downloads within 10 seconds. Ory follows up to three redirects within the same scheme, host,
and port. This applies to private_key_jwt client authentication, JWT client assertions, and signed request objects.
Breaking changes
A client whose jwks_uri redirects to another origin, serves a key set larger than 256 KiB, or takes longer than 10 seconds to
respond can no longer authenticate with keys from that location. Serve the key set from the origin of the registered jwks_uri,
or update the client's jwks_uri to the final location.
A key set that contains private key material is rejected. Publish only the public keys, and replace any key pair whose private key was published.