I just read up a bit on hasuras handling of JWTS / JWKS and came opon this part: https://hasura.io/docs/latest/auth/authentication/jwt/#rotating-jwks Mentioning the required headers to be sent for hasura to be aware of the fact that a refresh needs to happen, are these guidelines something that the jwks endpoint you guys have implemented follows? and if not, is it something I can override and fix?

I checked the response headers of the jwks.json URL and noticed that the header: Strict-Transport-Security: max-age=15724800; Which is Thursday the second of july 1970 00.00.00 Is there no way for me to override this and fix the header name + max age value to something that works with the actual refresh time and hasura? My boss was pushing me to see if I could fix this instead of having to wait a week, so I've got to ask: ) According to hasuras docs It will check for a max-age in Cache-Control header, so the requirement would be a name change for the header, I am guessing as well as updating the value of max-age to something that's in line with the actual next refresh of the JWKS.

When trying to override I noticed that there where no way to override through the session och passwordless recipies (those are the ones I am using). I found a override for the 'getJWKSGET' in the recipe/jwt. Would implementing and overriding that do what I want? Or do I have to go another route?

something like this:

Session.init({
    override: {
        openIdFeature: {
            jwtFeature: {
                apis: (oI) => {
                    return {
                        ...oI,
                        getJWKSGET: async function (input) {
                            let result = await oI.getJWKSGET!(input);
                            input.options.res.setHeader("custom-header", "custom-value", false);
                            return result;
                        }
                    }
                }
            }
        }
    }
})

Got everything to work! Super, I've just got a small concern, atm it refreshes the token every 60sec, which would in a worst case scenario mean that our hasura instance could work of an unvalid JWK for up to 59secs, and as such be uncontactable, I don't want to lower this value to 1sec to ensure that it doesn't happen, that feels like pretty bad solution having to check for a new JWK every 1sec, I noticed something weird in my setup, first was the fact that the header: Strict-Transport-Security: max-age=15724800; Is showing a max-age that is back in the 1970s, This header also dissappeard when i added the Cache-Control header needed for hasura. But what I am really wondering is if there's any way I can find out the actual expiration time of the JWK and use that for max-age, as that would eliminate any problems issuing from expired JWKs without having to spam the backend instance with requests.

Cause otherwise it just moves the problem to the other end of the spectrum, making sure that the new keys won't work for 59sec in a worst case scenario, if I am not mistaken? xD