[OFBIZ-11187] Use a JWT keyprovider

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: Trunk, Upcoming Branch
• Component/s: framework
• Assignee: Unassigned
• Reporter: Jacques Le Roux
• Created: 08/Sep/19 08:16
• Updated: 11/Jan/22 08:48

Description

There are several more or less ways to keep a JWT secret key safe. They are documented here

An even not costly and safer way is to use a JWT keyprovider . I think we should consider to do something like in the example demonstrated in this page, and as suggested there:

"with a simple key rotation using JWKS, try the jwks-rsa-java library."