DongHyeonkaandClaude Opus 5
aa2c3907f5
Adding a higher-priority RSA provider leaves both kids in JWKS, so tokens signed before and after the rotation both validate. Deleting the old provider makes its tokens 401 immediately, and the resource server's JWKS cache does not buy a grace period because an unknown kid triggers a refetch. The encryption key Q3 asks about does not exist yet, since B-2 showed the tokens are stored as plaintext JWTs, so the measured signing-key rotation is what its design has to copy: write with one key, read with several, and keep the overlap longer than the lifetime of anything signed with the old one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
17 lines
684 B
Plaintext
17 lines
684 B
Plaintext
=== [3] 키 회전 — 우선순위가 더 높은 RSA 공급자를 추가한다 ===
|
|
Created new component with id '7902af43-a0cc-4ebd-ad25-04d563854d16'
|
|
|
|
=== [4] 회전 후 JWKS — 옛 키가 남아 있는가 ===
|
|
RS256 키 수: 2
|
|
kid 목록:
|
|
{"keys":[{"kid":"1B4AQHoxZvFaQi1tc1byz8ifU-nYFB6engD4YB4Fz84"
|
|
{"kid":"gokjn0zFUok8r7JVqW1cxuyojH1bTT87vzfQG9RrFX4"
|
|
{"kid":"OY-caYDNGoP4HMAz-Q9UPTU-DM1i896NuzUZu6gfCqM"
|
|
|
|
=== [5] 새 토큰은 어느 키로 서명되는가 ===
|
|
새 토큰의 kid: 1B4AQHoxZvFaQi1tc1byz8ifU-nYFB6engD4YB4Fz84
|
|
|
|
=== [6] ★ 회전 전에 발급된 토큰은 아직 통하는가 ===
|
|
옛 토큰 /api/me HTTP 200
|
|
새 토큰 /api/me HTTP 200
|