starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Enhancement]: Automatic renewal of public JWK #2881

New Issue
Open
opened 2026-04-25 00:11:33 +02:00 by adam · 4 comments
adam commented 2026-04-25 00:11:33 +02:00
Owner
Copy Link
Copy Source

Originally created by @vehagn on GitHub (Jul 12, 2025).

Type of Enhancement

Server Backend

Describe the Feature/Enhancement

Audiobookshelf appears to cache the public JWK for validating JWTs. Restarting ABS appears to fetch the new key.

Why would this be helpful?

No need to restart ABS in order to update public JWK for JWT verification.

Future Implementation (Screenshot)

Try to fetch the public JWK again if JWT verification fails.

Audiobookshelf Server Version

v2.24.0

Current Implementation (Screenshot)

No response

Originally created by @vehagn on GitHub (Jul 12, 2025). ### Type of Enhancement Server Backend ### Describe the Feature/Enhancement Audiobookshelf appears to cache the public JWK for validating JWTs. Restarting ABS appears to fetch the new key. ### Why would this be helpful? No need to restart ABS in order to update public JWK for JWT verification. ### Future Implementation (Screenshot) Try to fetch the public JWK again if JWT verification fails. ### Audiobookshelf Server Version v2.24.0 ### Current Implementation (Screenshot) _No response_
adam added the enhancement label 2026-04-25 00:11:33 +02:00
adam commented 2026-04-25 00:11:34 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Jul 12, 2025):

Can you explain in more detail because this seems like a misunderstanding but I'm not quite sure

@advplyr commented on GitHub (Jul 12, 2025): Can you explain in more detail because this seems like a misunderstanding but I'm not quite sure
adam commented 2026-04-25 00:11:34 +02:00
Author
Owner
Copy Link
Copy Source

@vehagn commented on GitHub (Jul 12, 2025):

I was tinkering with my Authelia (OIDC provider) configuration and changed the JWK. ABS failed to verify any JWTs (according to the log messages) until I restarted the container. On the frontend I kept getting authentication failed messages.

@vehagn commented on GitHub (Jul 12, 2025): I was tinkering with my Authelia (OIDC provider) configuration and changed the JWK. ABS failed to verify any JWTs (according to the log messages) until I restarted the container. On the frontend I kept getting authentication failed messages.
adam commented 2026-04-25 00:11:34 +02:00
Author
Owner
Copy Link
Copy Source

@vehagn commented on GitHub (Jul 13, 2025):

@advplyr I understand I was a bit short so here's a step-by-step guide to reproduce

  1. Note the JWK used to sign JWT from the jwks_uri endpoint found from the .well-known/openid-configuration endpoint.
  2. Log into ABS using OIDC with Authelia as an IdP -> It works
  3. Rotate the JWK and restart Authelia to make sure it picks up the new JWK
  4. Check that the JWK used to sign the JWT has changed.
  5. Sign out of ABS
  6. Try to sign into ABS again and be met with an Unauthorized message
Image
  1. Check ABS logs to find ERROR: "[Auth] No data in openid callback - RPError: failed to validate JWT signature"
  2. Restart ABS
  3. Try to log into ABS again -> It works again!

My assumption is that ABS — or more probably the library ABS relies on, fetches the public JWKs on startup and doesn't refresh them.

This is related to Rotation of Asymmetric Signing Keys of the OIDC spec. BankID also has a page that explains key rotation and the different responsibilities.

It could also be a non-issue since Authelia doesn't yet support JWK Rotation (which is planned in the next release), so some important fields could be missing.

@vehagn commented on GitHub (Jul 13, 2025): @advplyr I understand I was a bit short so here's a step-by-step guide to reproduce 1) Note the JWK used to sign JWT from the `jwks_uri` endpoint found from the `.well-known/openid-configuration` endpoint. 2) Log into ABS using OIDC with Authelia as an IdP -> It works 3) Rotate the JWK and restart Authelia to make sure it picks up the new JWK 4) Check that the JWK used to sign the JWT has changed. 5) Sign out of ABS 6) Try to sign into ABS again and be met with an Unauthorized message <img width="415" height="464" alt="Image" src="https://github.com/user-attachments/assets/de655db1-44ea-42a7-8983-e2c92711db80" /> 7) Check ABS logs to find `ERROR: "[Auth] No data in openid callback - RPError: failed to validate JWT signature"` 8) Restart ABS 9) Try to log into ABS again -> It works again! My assumption is that ABS — or more probably the library ABS relies on, fetches the public JWKs on startup and doesn't refresh them. This is related to [Rotation of Asymmetric Signing Keys](https://openid.net/specs/openid-connect-messages-1_0-20.html#rotate.sig.keys) of the OIDC spec. BankID also has [a page that explains key rotation](https://developer.bankid.no/bankid-oidc-provider/core-concepts/key-rotation/) and the different responsibilities. It could also be a non-issue since Authelia doesn't yet support JWK Rotation ([which is planned in the next release](https://www.authelia.com/roadmap/active/openid-connect-1.0-provider/#beta-8)), so some important fields could be missing.
adam commented 2026-04-25 00:11:34 +02:00
Author
Owner
Copy Link
Copy Source

@Sapd commented on GitHub (Feb 5, 2026):

This is an Authelia problem.

Seems Authelia added JSON Web key rotation in Beta 8: https://www.authelia.com/roadmap/active/openid-connect-1.0-provider/
So it should work with Authelia v4.40

@Sapd commented on GitHub (Feb 5, 2026): This is an Authelia problem. Seems Authelia added JSON Web key rotation in Beta 8: https://www.authelia.com/roadmap/active/openid-connect-1.0-provider/ So it should work with Authelia v4.40
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#2881
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?