Problem

The current PyJWT library only support caching of single signing key. Ref to jpadilla#611

Even though it avoid the network call when the services periodically calling get_signing_key with same kid, the current implementation doesn't have any TTL so the cache is stored forever. Also it still makes network call when different kid is provided.

Solution & Implantation

• Add JWKSetCache object that stores jwk set with current timestamp
  • When user try to get signing key from jwk set, the service will try to check if the cache exist and not expired. If so, it will avoid the network call and return the cached jwk set.
  • If the network call throws any error, clear the cache.
  • If the service can't find matching kid from cached jwk set, it will make a new network call to get new jwk set and check again in new set
  • Add option to enable/disable jwk set cache and lifespan. Default lifespan is 5 minutes.
• Add unit tests to cover the added code
• Disable LRU cache for get_signing_key by default as suggested from this comment Cache signing keys jpadilla/pyjwt#611 (comment)