Fetch new key on JWT Signature Validation - go

Question

To give some context, I am trying to verify a JWT signature using Public Key. The public key expires after some amount of hrs which could change. Now the problem is that if the validation fails, I don't know if it failed because of an invalid Token, or the Public Key got expired.
To solve this, I am doing the following:
Fetch a new key from some URL when there is a validation error
Use the updated key to validate the token
If it still fails, then the JWT validation fails
Code
I have a HTTP Handler inside which a new instance of tokenValidator is created and then validate() is called on it.
keystore that is used to create the tokenValidator is initialized outside the handler
type tokenValidator struct {
keyStore *keystore.KeyStore
}
func (t *tokenValidator) validate(){
// get token
.....
// validate token
var err error
err = t.validateSignature(token, publicKeyName)
if err != nil {
t.keyStore.UpdateKeys() // fetch new keys and try again
err = t.validateSignature(token, publicKeyName)
if err != nil {
return nil, fmt.Errorf("pf token signature validation failed: %w", err)
}
}
}
Keystore
Now, I don't want all the failed validation requests to fetch the key from the URL instead I want to use the updated key for all the requests waiting to acquire the lock.
So, for example, if there are 100 parallel requests, I want the request that acquires lock to update the key. All the others should use the updated key.
type KeyStore struct {
Keys jwks.JWKPublicKeys // map[string]rsa.PublicKey
mu sync.Mutex
isKeyUpdated bool
}
func (k *KeyStore) UpdateKeys() error {
k.isKeyUpdated = false
k.mu.Lock()
defer k.mu.Unlock()
var err error
if !k.isKeyUpdated {
keysMap, err := retrieveKeysFromURL()
if err == nil {
k.Keys = *keysMap // update the Keys Map
k.isKeyUpdated = true
}
}
return err
}
I am new to concurrency-related topics and was wondering if this could be improved. Or if there is some other better solution to this problem?
Thanks

Answer 1

The idea that you reload keys when token validation fails is a big security risk. Someone can bombard your API with invalid keys to launch a DoS attack by forcing you to reload keys in a never-ending loop. Ideally, you should find a way to determine if a key has expired or not.
You can keep a cache using:
cache map[string]*Key
where
type Key struct {
once sync.Once
key rsa.PublicKey
}
When you expire a key, you can simply do:
cache.cache[id]=&Key{}
which will insert an empty key in the cache. To get the key value from the cache:
func GetPublicKey(id string) rsa.PublicKey {
cache.Lock()
k:=cache.cache[id]
if k==nil {
cache.cache[id]=&Key{}
}
cache.Unlock()
k.once.Do(func() {
k.key=loadPublicKey()
})
return k.key
}
This way, everybody will wait until one of the goroutines initializes the key.