Our security is changing, so I'm updating an Angular SPA application to use OpenID Connect. I found a nice library to help set things up. However, I've run into an issue where it tries to access the JWKS endpoint unsuccessfully; it's blocked by CORS even though my application has been whitelisted.
Neither I nor my cyber security counterparts are able to explain the issue. Please assume we've configured both ends correctly.
The recommendation I received was to switch to a library that didn't require that endpoint (in other words, skip the JWT validation). I'd most likely switch to this one; apparently another application is using it successfully.
From what I can tell, the JWKS endpoint is used to verify the authenticity of tokens. Dropping it makes me a little uneasy.
What security risks does this open us up to? Should I push back on this?