fix(apigatewayv2): verify tokens from Floci's own Cognito pools in-process #10

2026-10-25T13:49:38Z

Zakaria commented

2026-10-25 13:49:38 +00:00

A JWT authorizer on one of Floci's own user pools could never pass: the pool's
issuer is Floci's base URL (plain HTTP on localhost or a Compose service name),
and the verifier only fetches discovery and JWKS documents over HTTPS or from a
private IP literal. When the configured issuer is exactly one of this
emulator's pool issuers, read the pool's signing keys directly; they are the
keys it publishes at its JWKS URL. Every other issuer keeps the strict fetch.

A JWT authorizer on one of Floci's own user pools could never pass: the pool's issuer is Floci's base URL (plain HTTP on localhost or a Compose service name), and the verifier only fetches discovery and JWKS documents over HTTPS or from a private IP literal. When the configured issuer is exactly one of this emulator's pool issuers, read the pool's signing keys directly; they are the keys it publishes at its JWKS URL. Every other issuer keeps the strict fetch.

Zakaria added 1 commit 2026-10-25 13:49:38 +00:00

fix(apigatewayv2): verify tokens from Floci's own Cognito pools in-process d8d94a773d

A JWT authorizer on one of Floci's own user pools could never pass: the pool's
issuer is Floci's base URL (plain HTTP on localhost or a Compose service name),
and the verifier only fetches discovery and JWKS documents over HTTPS or from a
private IP literal. When the configured issuer is exactly one of this
emulator's pool issuers, read the pool's signing keys directly; they are the
keys it publishes at its JWKS URL. Every other issuer keeps the strict fetch.

Zakaria merged commit 9f17f72cc3 into main

2026-10-25 13:49:42 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Zakaria/FlociClone#10