Lazy JWT Key Rotation in .NET: Redis-Powered JWKS That Just Works

https://www.aaronpina.com/lazy-jwt-key-rotation-in-net-redis-powered-jwks-that-just-works/

13•aaronpina•1d ago

Comments

time4tea•2h ago

The key material is in redis? Seems odd. Should be in fips 140 hsm? Else key can be stolen easy.

Maybe missed something.

a_random_name•2h ago

(glanced at it so I could be wrong) They're talking about a public key that can be used to validate the JWT's authenticity. AFAIK there is no need to keep these secret, and it's not possible to (without breaking public key crypto) forge them so it should be safe to store them wherever.

time4tea•2h ago

From article:

Private key redis key

    public static string PrivateKey(string kid) => $"{Root}:jwks:private:{kid}"; // full private material (short life)

a_random_name•2h ago

TY, that seems like not the best practice.

nijave•2h ago

How can the key be stolen easily? That really depends on the security of the Redis setup. Redis is typically not internet accessible so you'd need some sort of server exploit.

Would have been good if the article example showed a Redis server with TLS and password auth.

time4tea•2h ago

Private key material should not be kept in the clear anywhere, ideally. This includes on your dev machine, serialised in a store, in the heap of your process, anywhere. Of course, it depends on your threat environment, but the article did mention pci-dss. If you put it in redis, then anyone that has access (internal baddies exist too!) can steal the key and sign something. Its hard to repudiate that.

flumpcakes•51m ago

How far do you go, how do you use the private key to sign something if you can't keep it anywhere?

JackSlateur•47m ago

TPM

You never have the private key, only the ability to ask something to encrypt/sign something

legulere•33m ago

Much simpler: just store session ids in Redis.

I skimmed over the previous articles in this blog and they don't seem to mention the one use case JWTs were made for: having a separate authentication server from the application server. Most developers will only need this for integrating into corporations with single sign in or social logins (sign in with Facebook/google/apple...). There you won't write the authentication server but integrate with them. Session Ids are dead simple to get right securely. Just use them.

Building a Procedural Hex Map with Wave Function Collapse

Bluesky CEO Jay Graber is stepping down

JSLinux Now Supports x86_64

Show HN: The Mog Programming Language

DARPA's new X-76

Launch HN: Terminal Use (YC W26) – Vercel for filesystem-based agents

Fixfest is a global gathering of repairers, tinkerers, and activists

Restoring a Sun SPARCstation IPX part 1: PSU and NVRAM (2020)

Show HN: DenchClaw – Local CRM on Top of OpenClaw

Flash media longevity testing – 6 years later

Fontcrafter: Turn Your Handwriting into a Real Font

Florida judge rules red light camera tickets are unconstitutional

Rethinking Syntax: Binding by Adjacency

Jolla on track to ship new phone with Sailfish OS, user-replaceable battery

Ireland shuts last coal plant, becomes 15th coal-free country in Europe (2025)

An opinionated take on how to do important research that matters

Reverse-engineering the UniFi inform protocol

What I Always Wanted to Know about Second Class Values

FreeBSD Capsicum vs. Linux Seccomp Process Sandboxing

Velxio, Arduino Emulator

Uber reported to the state that I was fired for "annoying a coworker."

US Court of Appeals: TOS may be updated by email, use can imply consent [pdf]

Algebraic topology: knots links and braids

Durdraw – ANSI art editor for Unix-like systems

Workers report watching Ray-Ban Meta-shot footage of people using the bathroom

Is legal the same as legitimate: AI reimplementation and the erosion of copyleft

FFmpeg at Meta: Media Processing at Scale

Unlocking Python's Cores:Energy Implications of Removing the GIL

Show HN: VS Code Agent Kanban: Task Management for the AI-Assisted Developer

Grammarly is offering ‘expert’ AI reviews from famous dead and living writers

Building a Procedural Hex Map with Wave Function Collapse

Bluesky CEO Jay Graber is stepping down

JSLinux Now Supports x86_64

Show HN: The Mog Programming Language

DARPA's new X-76

Launch HN: Terminal Use (YC W26) – Vercel for filesystem-based agents

Fixfest is a global gathering of repairers, tinkerers, and activists

Restoring a Sun SPARCstation IPX part 1: PSU and NVRAM (2020)

Show HN: DenchClaw – Local CRM on Top of OpenClaw

Flash media longevity testing – 6 years later

Fontcrafter: Turn Your Handwriting into a Real Font

Florida judge rules red light camera tickets are unconstitutional

Rethinking Syntax: Binding by Adjacency

Jolla on track to ship new phone with Sailfish OS, user-replaceable battery

Ireland shuts last coal plant, becomes 15th coal-free country in Europe (2025)

An opinionated take on how to do important research that matters

Reverse-engineering the UniFi inform protocol

What I Always Wanted to Know about Second Class Values

FreeBSD Capsicum vs. Linux Seccomp Process Sandboxing

Velxio, Arduino Emulator

Uber reported to the state that I was fired for "annoying a coworker."

US Court of Appeals: TOS may be updated by email, use can imply consent [pdf]

Algebraic topology: knots links and braids

Durdraw – ANSI art editor for Unix-like systems

Workers report watching Ray-Ban Meta-shot footage of people using the bathroom

Is legal the same as legitimate: AI reimplementation and the erosion of copyleft

FFmpeg at Meta: Media Processing at Scale

Unlocking Python's Cores:Energy Implications of Removing the GIL

Show HN: VS Code Agent Kanban: Task Management for the AI-Assisted Developer

Grammarly is offering ‘expert’ AI reviews from famous dead and living writers

Lazy JWT Key Rotation in .NET: Redis-Powered JWKS That Just Works

Comments