keys
Registry Context
A JWK Set contains a `keys` array of JWKs. By default, their order does not indicate preference.
Technical Summary
A JWK Set is a JSON object whose required `keys` member is an array of JWK values. Member names must be unique. Parsers must reject duplicate names or retain only the lexically last duplicate. Unrecognized additional members must be ignored.
When Used
When creating, parsing, validating, or serializing a JWK Set.
Normative Requirements
implementation encountering an additional JWK Set member
RFC 7517 - Section 5
ignore the member.
Condition: when the additional member is not understood
if not understood by implementations encountering them, they MUST be ignored.
implementation processing a JWK Set
RFC 7517 - Section 5
ignore affected JWKs.
Condition: when their "kty" values are not understood, required members are missing, or values are outside supported ranges
Implementations SHOULD ignore JWKs within a JWK Set that use "kty" values that are not understood by them, that are missing required members, or for which values are out of the supported ranges.
JWK Set
RFC 7517 - Section 5
have unique member names.
The member names within a JWK Set MUST be unique.
JWK Set JSON object
RFC 7517 - Section 5
have a "keys" member whose value is an array of JWKs.
The JSON object MUST have a "keys" member, with its value being an array of JWKs.
RFC 7517 - Section 5
contain whitespace and/or line breaks.
This JSON object MAY contain whitespace and/or line breaks.
JWK Set parser
RFC 7517 - Section 5
either reject JWK Sets with duplicate member names or use a JSON parser that returns only the lexically last duplicate member name.
Condition: when duplicate member names are present
JWK Set parsers MUST either reject JWK Sets with duplicate member names or use a JSON parser that returns only the lexically last duplicate member name.
Validation Guidance
Verify that the JWK Set contains a `keys` member whose value is an array.
Accept otherwise valid JWK Sets containing JSON whitespace or line breaks.
Reject duplicate JWK Set member names or ensure the parser retains only the lexically last duplicate.
Ignore additional JWK Set members that the implementation does not understand.
Ignore JWKs with unsupported `kty` values, missing required members, or values outside supported ranges unless there is a documented reason not to follow the recommendation.
Reference
Details
- Entry Id
keys- Parameter Name
keys- Parameter Description
Array of JWK Values- Change Controller
IESG- Reference
RFC7517 - Section 5.1