RE verifying JWTs with AWS KMS. It's possible to ...
# server
a
RE verifying JWTs with AWS KMS. It's possible to call the KMS API for every single verification, but it seems possible to download the KMS public key and then proceed to use that. Undoubtedly, this is the ideal route for long-lived applications, but it's less clear for serverless applications on AWS Lambda, where cold-start is important to optimize for. It seems to me that downloading and using the public key would always be slower the first time rather than just verifying with the API. However, I haven't yet tested this. Does anyone have any experience with this tradeoff?
d
I'd have thought that downloading the key would give 2 major advantages: 1. You only incur the problem for the first request. 2. Calling KMS for every call could get pretty expense pretty fast ­čÖâ
We tend to download and verify for this very reason. Are your cold start requirements really that tight?
a
I don't foresee this application getting much use, but cost is still an interesting point to consider. I don't have hard requirements for cold-start, but I find it's much more important for low-usage apps; where you're almost guaranteed to have several cold-starts before your page loads. It seems to at least be worth looking into.
BTW, I know you've done the same thing before (with nimbus JWT), so I'd be interested in your feedback once I'm done with the adapter.
c
We always cache keys (from KMS or Secrets Manager) for both performance and cost reasons.
d
yep - they are public after all, so there is no harm in sticking them into Redis or similar ­čÖé