feat: JWKSValidator — JWT signature verification via JWKS (RFC 7517)

[kalidke]

Summary

OAuth Resource Server hardening, phase 1 of the 0.6 plan (issue #51 context): JWTs from external authorization servers can now be cryptographically verified against the server's published JWKS. Previously JWTValidator validated claims only (documented limitation since #42).

• New JWKSValidator <: TokenValidator (exported): verifies RSA signatures via JWTs.jl, then applies the same fail-closed claim validation as JWTValidator (iss/aud/exp/nbf/scopes, reused via validate_jwt_claims).
• Header gate before any cryptography: malformed tokens, alg=none, non-allowlisted algorithms (default RS256/RS384/RS512), and missing kid are all rejected up front.
• Key rotation with DoS protection: unknown kid triggers a JWKS re-fetch, rate-limited to one attempt per refresh_interval_seconds (default 300) — JWTs.jl's built-in auto-refresh-per-unknown-kid is deliberately bypassed because it lets attacker-supplied kid values hammer the JWKS endpoint. Fetches use bounded HTTP timeouts (10s connect/read) and run outside the validator lock so a hanging AS cannot block all authentication.
• Lazy loading: construction never touches the network — a server can start while its AS is down; requests fail closed until keys load.
• file:// JWKS and pre-built JWTs.JWKSet injection supported (tests, air-gapped).

New dependency: JWTs.jl 0.3 (JuliaWeb; brings JSON.jl + MbedTLS transitively). MbedTLS added to test extras for fixture signing.

Security cases covered by tests (28 new, suite 893/893)

• kid spoofing (token signed by key B claiming kid A) → rejected
• tampered payload with original signature → rejected
• corrupted / empty signature → rejected
• alg=none, HS256 (not allowlisted), missing kid, malformed → rejected pre-crypto
• expired / wrong-audience / missing-scope after valid signature → rejected
• rotation: new kid validates after re-fetch; within rate-limit window fails closed while cached keys keep working
• fetch_jwks_keys fail-closed on bad JSON / missing keys / missing file
• end-to-end AuthMiddleware + allowlist deny

Test fixtures are freshly generated, committed, test-only RSA keypairs (never used anywhere else).

Versioning

Additive → ships in 0.5.5 (per the 0.5.x policy). The JWKS-by-default flip for JWTValidator remains clustered in 0.6.0.

🤖 Generated with Claude Code

[kalidke]

Codex security review — addressed

Ran an adversarial security review (Codex) on the validator. No BLOCKs, and it confirmed the core design holds against the main JWT bypass classes: kid is lookup-only (never reaches the fetch URL), the alg allowlist runs before any cryptography, JWTs.validate! cross-checks the token alg against the resolved key's algorithm (so RS/HS confusion and alg=none/signature-strip don't validate), and a fresh JWT is built per request (no isverified reuse hazard).

Fixed the 4 actionable WARNs in ea5773c:

Finding	Fix
Plaintext http:// JWKS allows MITM key swap	Rejected at construction; allow_insecure_http=true opt-in for localhost/testing. https:///file:// always allowed
No byte cap on JWKS response/file; refresh_interval_seconds could be ≤0	Streaming read aborts past MAX_JWKS_BYTES (1 MB) + file:// size pre-check; negative interval clamped to 0
Malformed JWK entry throws out of JWTs.refresh! → 500	Wrapped; fails auth closed and retains cached keys
Non-numeric nbf silently ignored	Rejected as malformed (also hardens JWTValidator, shared path)

Deferred (documented): duplicate JSON member names in header/payload (WARN). This is not a local bypass — the signature binds the exact token bytes, and the package decodes each segment exactly once, so what's validated is what was signed. The residual risk is cross-component smuggling if a different component re-parses the token with first-wins semantics; detecting it requires a custom duplicate-key JSON scan (JSON3 collapses duplicates last-wins). Low value for the current single-validator path; will revisit if a second token-reparsing component is added. The Content-Type NIT was also skipped (JSON-parse + keys extraction already gate use).

Suite 906/906.