A JWT authorizer on one of Floci's own user pools could never pass: the pool's
issuer is Floci's base URL (plain HTTP on localhost or a Compose service name),
and the verifier only fetches discovery and JWKS documents over HTTPS or from a
private IP literal. When the configured issuer is exactly one of this
emulator's pool issuers, read the pool's signing keys directly; they are the
keys it publishes at its JWKS URL. Every other issuer keeps the strict fetch.
Zakaria
d8d94a773d