This PR adds an optional refresh_jwks_on_kid_mismatch option to the OIDC discovery mechanism.
When enabled, Symfony will automatically refresh the JWKS if the kid (Key ID) in the JWT header
is not found in the cached key set.

This prevents token validation failures in cases where the OIDC provider’s signing keys
have changed while the cached key set has not yet expired.

Example configuration:

oidc:claim:emailalgorithms:['ES256', 'RS256']audience:'api-example'issuers:['https://oidc.example.com']discovery:base_uri:https://www.example.com/realms/demo/refresh_jwks_on_kid_mismatch:true

Ali-HENDA requested a review fromchalasr as acode owner

November 10, 2025 10:18

carsonbot added Status: Needs Review Feature labels

Nov 10, 2025

carsonbot added this to the7.4 milestone

Nov 10, 2025

Copy link

carsonbot commentedNov 10, 2025

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has acontribution guide which I suggest you to read.

In short:

Always add tests
Keep backward compatibility (seehttps://symfony.com/bc).
Bug fixes must be submitted against the lowest maintained branch where they apply (seehttps://symfony.com/releases)
Features and deprecations must be submitted against the 7.4 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

carsonbot changed the title~~security-bundle: refresh JWKS on kid mismatch during OIDC discovery~~ security-bundle: refresh JWKS on kid mismatch during OIDC discovery

Nov 10, 2025

Ali-HENDA force-pushed thefeature/oidc-refresh-jwks-on-kid-mismatch branch 3 times, most recently froma938bec toe3626e0Compare

November 10, 2025 11:12

security-bundle: refresh JWKS on kid mismatch during OIDC discovery

b778601

Ali-HENDA force-pushed thefeature/oidc-refresh-jwks-on-kid-mismatch branch frome3626e0 tob778601Compare

November 10, 2025 11:16