Occasional 5xx errors from Auth0 JWKS endpoint

anish1 · September 7, 2022, 3:27pm

We have a backend with code similar to the Python quickstart for Auth0 that fetches the JWKS from "https://"+AUTH0_DOMAIN+"/.well-known/jwks.json". Last week, we were seeing ephemeral errors when hitting this endpoint, including:

HTTP 500 (internal server error)
HTTP 503 (service temporarily unavailable)
An SSL handshake failure

Should we be worried about this? Was there some sort of Auth0 outage last week? Or do we need to build our code to be tolerant of this API endpoint being flaky?

We’ve started caching the JWKS (mostly to improve latency, to avoid having to fetch the JWKS for every request), and incidentally, we haven’t seen 5xx errors from this API endpoint since then, but I’m not sure if that’s just because we’re making fewer requests overall, and whether we’re going to run into the same issue, just after a longer period of time.

tyf · October 8, 2022, 12:10am

Hey there @anish1 welcome to the community!

Apologize for the delayed response but wanted to get to this one.

I just did a bit of digging and am not seeing any outage around the time mentioned so I unfortunately don’t have an answer there.

I’m wondering if you were running into rate limits. Regardless, I’m happy to hear you’re no longer experiencing this after caching, which is the recommend approach. You can see in following code we default to 10 minutes in our auth0-Python:

github.com

auth0/auth0-python/blob/f15520b8390ee7ba131a2dc45b0f96591b96bd95/auth0/v3/authentication/token_verifier.py#L117


      
              """
          
              def __init__(self, jwks_url, algorithm="RS256"):
                  super(AsymmetricSignatureVerifier, self).__init__(algorithm)
                  self._fetcher = JwksFetcher(jwks_url)
          
              def _fetch_key(self, key_id=None):
                  return self._fetcher.get_key(key_id)
          
          
          class JwksFetcher(object):
              """Class that fetches and holds a JSON web key set.
              This class makes use of an in-memory cache. For it to work properly, define this instance once and re-use it.
          
              Args:
                  jwks_url (str): The url where the JWK set is located.
                  cache_ttl (str, optional): The lifetime of the JWK set cache in seconds. Defaults to 600 seconds.
              """
          
              CACHE_TTL = 600  # 10 min cache lifetime

system · October 22, 2022, 12:11am

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.