{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/2564","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer4","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/2564/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/2564/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/2564/events","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/2564","id":352806646,"node_id":"MDU6SXNzdWUzNTI4MDY2NDY=","number":2564,"title":"Q: Support for caching and/or rotating signing keys?","user":{"login":"ChineseWelshman","id":42595510,"node_id":"MDQ6VXNlcjQyNTk1NTEw","avatar_url":"https://avatars3.githubusercontent.com/u/42595510?v=4","gravatar_id":"","url":"https://api.github.com/users/ChineseWelshman","html_url":"https://github.com/ChineseWelshman","followers_url":"https://api.github.com/users/ChineseWelshman/followers","following_url":"https://api.github.com/users/ChineseWelshman/following{/other_user}","gists_url":"https://api.github.com/users/ChineseWelshman/gists{/gist_id}","starred_url":"https://api.github.com/users/ChineseWelshman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ChineseWelshman/subscriptions","organizations_url":"https://api.github.com/users/ChineseWelshman/orgs","repos_url":"https://api.github.com/users/ChineseWelshman/repos","events_url":"https://api.github.com/users/ChineseWelshman/events{/privacy}","received_events_url":"https://api.github.com/users/ChineseWelshman/received_events","type":"User","site_admin":false},"labels":[{"id":290038719,"node_id":"MDU6TGFiZWwyOTAwMzg3MTk=","url":"https://api.github.com/repos/IdentityServer/IdentityServer4/labels/question","name":"question","color":"cc317c","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-08-22T05:19:45Z","updated_at":"2018-08-23T21:30:38Z","closed_at":"2018-08-23T21:30:38Z","author_association":"NONE","body":"\r\n\r\nRelying Parties and other Clients use the public keys made available from the jwks endpoint to validate the signature on tokens issued by Identity Server 4. The OIDC spec recommends using the HTTP `Cache-Control` Header option and the `max-age` directive to inform clients how long they can cache the public keys for before returning to the _jwks_uri_ location to retrieve replacement keys from the IdP.\r\n\r\nhttp://openid.net/specs/openid-connect-core-1_0.html#RotateEncKeys\r\n\r\nThere are good reasons to support this functionality:-\r\n\r\n- Caching the keys improves the performance of the solution and reduces the load on the OP;\r\n- In the rare chance that the private key is compromised, being able to limit the time 3rd parties rely on the currency of the public keys enable certificate revocation mitigations to be implemented to take effect at the next expiry of the cached keys.\r\n\r\n\r\n1. Are there any existing configuration options to modify the behaviour of Identity Server 4 to support caching of public keys by relying parties and other clients?\r\n2. If not, can support for this feature be added to the backlog?\r\n\r\n### Issue / Steps to reproduce the problem\r\nTracing an access token validation between a relying party and the OP, it appears that Identity Server does not include a `Cache-Control` option in the Header of a HTTP Response to a request to the _jwks_uri_ endpoint.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/comments/415577526","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/2564#issuecomment-415577526","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/2564","id":415577526,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNTU3NzUyNg==","user":{"login":"ChineseWelshman","id":42595510,"node_id":"MDQ6VXNlcjQyNTk1NTEw","avatar_url":"https://avatars3.githubusercontent.com/u/42595510?v=4","gravatar_id":"","url":"https://api.github.com/users/ChineseWelshman","html_url":"https://github.com/ChineseWelshman","followers_url":"https://api.github.com/users/ChineseWelshman/followers","following_url":"https://api.github.com/users/ChineseWelshman/following{/other_user}","gists_url":"https://api.github.com/users/ChineseWelshman/gists{/gist_id}","starred_url":"https://api.github.com/users/ChineseWelshman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ChineseWelshman/subscriptions","organizations_url":"https://api.github.com/users/ChineseWelshman/orgs","repos_url":"https://api.github.com/users/ChineseWelshman/repos","events_url":"https://api.github.com/users/ChineseWelshman/events{/privacy}","received_events_url":"https://api.github.com/users/ChineseWelshman/received_events","type":"User","site_admin":false},"created_at":"2018-08-23T21:30:38Z","updated_at":"2018-08-23T21:30:38Z","author_association":"NONE","body":"Ok, Thanks."}}
{"actor":{"display_login":"ChineseWelshman"}}