Skip to content

fix(auth0): stop rediscovering the jwks uri on every verifier - #6782

Open
chiruu12 wants to merge 1 commit into
keephq:mainfrom
chiruu12:fix/auth0-discovery-per-construction
Open

chiruu12 wants to merge 1 commit into
keephq:mainfrom
chiruu12:fix/auth0-discovery-per-construction

Conversation

@chiruu12

@chiruu12 chiruu12 commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Fixes #6781

__init__ re-ran OIDC discovery and assigned it to self.jwks_uri. Nothing reads that attribute. _verify_bearer_token takes its signing key from the module level jwks_client, which was built from the discovery that already ran at import, so the second lookup could never return anything the first one had not.

The attribute now carries that same value. The second request is gone, and jwks_uri is set to None alongside jwks_client when AUTH0_DOMAIN is unset so the name exists on both paths.

It adds up. get_auth_verifier builds a new verifier per call and sits in 190 route dependencies, which FastAPI evaluates at import, so AUTH_TYPE=AUTH0 meant 190 discarded discovery requests at startup with a 10 second timeout apiece.

Three tests. Import discovers exactly once, three constructions add no further requests, and the constructed verifier still carries the discovered URI. Only the middle one fails on the parent commit; the other two pass either way and are controls, not reproductions.

tests/test_auth0_authverifier.py: 3 passed. tests/test_auth.py tests/test_auth_new.py: 27 passed. ruff check clean.

This does not fix the unit-tests timeouts on #6716. Those come from the import time call being unmocked for MULTI_TENANT in tests/fixtures/client.py, which is a separate thing and I did not touch it here.

Copilot AI lite review requested due to automatic review settings September 7, 2026 21:59

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Auth0AuthVerifier re-runs OIDC discovery on every construction and discards the result

2 participants