Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the bug has not already been reported

Fastify version

5.1.0

Plugin version

9.0.2

Node.js version

22.12.0

Operating system

macOS

Operating system version (i.e. 20.04, 11.3, 10)

15.1.1

Description

createVerifier seems to be called to create a new fast-jwt verifier instance for every incoming request. Not only is this expensive in itself, but the fast-jwt cache is not used even if enabled using the options.

Testing on my local machine. Macbook M1 Pro. 10,000 requests. verify/createVerifier takes ~2.6s which is %5-20% of total response time depending on the endpoint.

Note: The endpoint I'm using here to test is quite complex, so simpler endpoints would see a bigger impact.

When I monkeyPatch @fastify/jwt to reuse the verifier per key (we only use a single publicKey from a JWKS endpoint), verify/createVerifier only take 400ms.

Here's an example of our @fastify/jwt options

server.register(fastifyJwt, {
    decode: { complete: true },
    verify: {
      cache: true, // Performance is the same / better with this set to false as cache is bypassed
      algorithms: ['RS256'],
      allowedAud: verifyAud,
      allowedIss: verifyIss,
      requiredClaims,
    },
    secret: async (request, token) => {
      const {
        header: { kid },
      } = token
      const key = await jwksClient.getSigningKey(kid)
      return key.getPublicKey()
    },
    formatUser,
  })

Link to code that reproduces the bug

No response

Expected Behavior

I expect createVerifier to only be called once per publicKey.