I want to build an authentication service that uses JWT with signatures generated using RS256. In a single-server solution, the implementation is rather straightforward. However, when it comes to making it multi-node there are two related issues to which I'm not finding clear answers:

  1. In a cluster solution, should every server use its own key pair? In that case how to build efficiently a JWK that doesn't contain too many keys?

  2. On the other hand, if sharing the private key is possible without incurring major security issues, which is the best approach to share the key and manage its rotation?

  • I suggest using the multi-key approach. There even is a well-known "kid" claim (rfc-editor.org/rfc/rfc7515#section-4.1.4) that allows to identify the correct key used. You might as well move validation towards another centralized service though.
    – Beltway
    Nov 8 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.