{
  "id": "security/oauth2-jwk-set-without-kid",
  "signature": "JWT verification failed: no matching key found in JWKS for kid 'abc123'",
  "signature_zh": "JWT验证失败：在JWKS中找不到与kid 'abc123'匹配的密钥",
  "regex": "JWT verification failed: no matching key found in JWKS for kid '.*'",
  "domain": "security",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "The JWT contains a 'kid' header that does not match any key ID in the JSON Web Key Set (JWKS) fetched from the identity provider, often due to caching stale JWKS or misconfigured key rotation.",
  "root_cause_type": "generic",
  "root_cause_zh": "JWT的'kid'头与从身份提供者获取的JSON Web Key Set（JWKS）中的任何密钥ID都不匹配，通常是由于JWKS缓存过期或密钥轮换配置错误。",
  "versions": [
    {
      "version": "jsonwebtoken 8.5.1",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "jose 4.14.4",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Keycloak 20.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Auth0 Node.js SDK 3.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Restarting the server only clears the in-memory cache, but if the JWKS is cached in a shared store like Redis, the stale keys persist and the error remains.",
      "fail_rate": 0.4,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Hardcoding the public key in the code bypasses the JWKS entirely, but it breaks when the identity provider rotates keys, leading to future authentication failures.",
      "fail_rate": 0.6,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Disabling JWT signature validation entirely removes the security check, leaving the application vulnerable to forged tokens and is never an acceptable fix.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Refresh the JWKS cache before validation. In Node.js with jose library, set a shorter cache duration and force refresh on error: `const keys = await client.getSigningKeys(true);`",
      "success_rate": 0.8,
      "how": "Refresh the JWKS cache before validation. In Node.js with jose library, set a shorter cache duration and force refresh on error: `const keys = await client.getSigningKeys(true);`",
      "condition": "",
      "sources": []
    },
    {
      "action": "Ensure the identity provider's JWKS endpoint is reachable and the 'kid' values align. Use `curl https://your-idp.com/.well-known/jwks.json` and compare the 'kid' values with the token header.",
      "success_rate": 0.75,
      "how": "Ensure the identity provider's JWKS endpoint is reachable and the 'kid' values align. Use `curl https://your-idp.com/.well-known/jwks.json` and compare the 'kid' values with the token header.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Implement a fallback: if 'kid' is missing in the JWT, try all keys in the JWKS to find a match. This handles legacy tokens but should be deprecated for security.",
      "success_rate": 0.7,
      "how": "Implement a fallback: if 'kid' is missing in the JWT, try all keys in the JWKS to find a match. This handles legacy tokens but should be deprecated for security.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "在验证之前刷新JWKS缓存。在Node.js中使用jose库时，设置较短的缓存持续时间并在出错时强制刷新：`const keys = await client.getSigningKeys(true);`",
    "确保身份提供者的JWKS端点可访问且'kid'值一致。使用`curl https://your-idp.com/.well-known/jwks.json`并将'kid'值与令牌头进行比较。",
    "实现回退机制：如果JWT中缺少'kid'，尝试使用JWKS中的所有密钥进行匹配。这可以处理旧令牌，但出于安全考虑应弃用。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://auth0.com/docs/secure/tokens/json-web-tokens/validate-json-web-tokens",
  "official_doc_section": null,
  "error_code": "JWT_JWKS_KID_MISMATCH",
  "verification_tier": "ai_generated",
  "confidence": 0.85,
  "fix_success_rate": 0.85,
  "resolvable": "partial",
  "first_seen": "2023-02-15",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}