JWT::JWK::Set raises on an unknown `kty`, failing the whole set (RFC 7517 §5)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 68/100
Research direction
Read the JWT::JWK::Set construction path and its handling of unsupported key types, then add coverage for a JWKS containing both a recognized key and an unknown kty. Verify that the unknown member is ignored while the recognized key remains available for lookup and verification. The issue offers a reproduction harness, but does not name specific source or test files.
Written by the indexing model from the issue text.
Description
Summary
Building a JWT::JWK::Set from a JWKS that contains a key with an unrecognised kty raises JWT::JWKError: Key type AKP not supported, so the whole set fails. Per RFC 7517 section 5 an unrecognised key should be ignored, not fatal, so one post-quantum key in a published JWKS takes down verification of the classical keys with it.
Reproduction
require "jwt"
JWT::JWK::Set.new(mixed_jwks) # RSA + one {"kty" => "AKP", ...} (ML-DSA, RFC 9964)
# JWT::JWKError: Key type AKP not supported
Measured against ruby-jwt 3.2.0. The set builds fine once the AKP key is removed. Fixture and probe available on request.
Why this matters
RFC 7517 section 5: "Implementations SHOULD ignore JWKs within a JWK Set that use kty values that are not understood by them." ML-DSA (FIPS 204 / RFC 9964, kty: "AKP") is starting to appear in published key sets as post-quantum migration begins. When an issuer adds one to a JWKS that ruby-jwt consumers read, those consumers stop verifying every signature from that issuer, including classical RS256/ES256, on a spec-compliant key publication they do not control. In federated deployments that is an externally triggered outage.
Suggested fix
When constructing a JWT::JWK::Set, skip a member whose kty is unsupported (optionally surface it) rather than raising, so the recognised keys still load and remain usable for kid lookup. This implements the RFC section 5 SHOULD and leaves recognised keys unchanged.
Offer
Happy to share the reproduction harness (mixed classical + AKP JWKS plus a control) and to open a PR with the per-key skip and a test.
- Dominant language
- Ruby
- Stars
- 3.7k
- Forks
- 381
- Avg merge
- 17h 10m
- Merged PRs (30d)
- 11
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from jwt/ruby-jwt
-
Difficulty 4/5 3-5 days Newbie friendliness 15/100
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
jwt/ruby-jwt#723 · 2 comments ·
Maintainers usually reply within 1 day
-
feature
Difficulty 5/5 Over a week Newbie friendliness 35/100
jwt/ruby-jwt#428 · 7 comments · 1 reaction ·
Maintainers usually reply within 1 day
-
enhancement feature help wanted up for grabs
Difficulty 5/5 Over a week Newbie friendliness 25/100
jwt/ruby-jwt#80 · 11 comments · 8 reactions ·
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
TheOdinProject/curriculum#31512 ·
Maintainers usually reply within 1 day
-
area/web interface
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
ruby-grape/grape-swagger#1014 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
rubys/roundhouse#1757 ·