šŸš€ Big News: Socket Acquires Coana to Bring Reachability Analysis to Every Appsec Team.Learn more →

jwks-rsa

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install
n

jwks-rsa

Library to retrieve RSA public keys from a JWKS endpoint

3.2.0
latest
99

Supply Chain Security

100

Vulnerability

95

Quality

85

Maintenance

100

License

Version published
Weekly downloads
4.5M
0.75%
Maintainers
45
Weekly downloads
 
Created
Issues
20

What is jwks-rsa?

The jwks-rsa npm package is a library that helps to retrieve RSA signing keys from a JWKS (JSON Web Key Set) endpoint. It is primarily used in scenarios where you need to verify the signature of JSON Web Tokens (JWTs) against public keys published in a JWKS. This is common in modern authentication flows, especially those implementing OpenID Connect.

What are jwks-rsa's main functionalities?

Retrieving RSA signing keys

This feature allows you to retrieve RSA signing keys from a JWKS endpoint. The `getSigningKey` method is used to fetch the key using the `kid` (key ID) from the JWT header. This is useful for verifying JWT signatures.

const jwksClient = require('jwks-rsa');
const client = jwksClient({
  jwksUri: 'https://your-domain.com/.well-known/jwks.json'
});

function getKey(header, callback){
  client.getSigningKey(header.kid, function(err, key) {
    var signingKey = key.publicKey || key.rsaPublicKey;
    callback(null, signingKey);
  });
}

Integrating with Express.js for JWT authentication

This code snippet demonstrates how to use jwks-rsa with express-jwt middleware for securing Express.js applications. The `expressJwtSecret` method is used to dynamically provide a signing key based on the incoming JWT's `kid`.

const jwt = require('express-jwt');
const jwksRsa = require('jwks-rsa');

const checkJwt = jwt({
  secret: jwksRsa.expressJwtSecret({
    cache: true,
    rateLimit: true,
    jwksRequestsPerMinute: 5,
    jwksUri: 'https://your-domain.com/.well-known/jwks.json'
  }),
  audience: 'your-audience',
  issuer: 'https://your-domain.com/',
  algorithms: ['RS256']
});

Other packages similar to jwks-rsa

Keywords

FAQs

Package last updated on 18 Mar 2025

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts