In nimbus-jose-jwt, what is difference between lifespan and refreshTime?

Question

The class DefaultJWKSetCache of nimbus-jose-jwt has two fields, lifespan and refreshTime.
From Java docs -

lifespan - The lifespan of the cached JWK set before it expires, negative means no expiration.
refreshTime - The time after which the cached JWK set is marked for refresh, negative if not specified. Should be shorter or equal to the lifespan.

What is the difference between these two. Does it mean that,
after the lifespan expiry the cached JWK set will be evicted and loaded again from jwks remote url (saying remote url as i am using RemoteJWKSet).
and after the refresh expiry the existing JWK set will be updated with the keys retrieved from remote url.

But i don't understand the practical difference between the two. Both seem to be doing same. Can some one explain the details with more granularity and any example.

Edit - if i give no expiry for lifespan, and 1 hour expiry for refreshTime, am i guaranteed that my keys will be updated every one hour.

Hecatomb

Answer 1

The lifespan is the time after which the DefaultJWKSetCache will evict cached JWKSet. I.e., after lifespan time units passed since the cache was populated the calls to JWKSetCache.get() will always return null until new JWKSet is stored to the cache.

The refreshTime is the time that impacts value returned by JWKSetCache.requiresRefresh() method. After refreshTime time units passed since the cache was populated this method will return true, otherwise, it will return false. This setting does not impact cache behavior in any way.

The RemoteJWKSet uses the value returned by JWKSetCache.requiresRefresh() to re-download JWKSet from remote URL before the cache is actually expired. This is why documentation recommends to set refreshTime to a lesser value than lifespan.

Currently, RemoteJWKSet triggers download of remote JWKSet when either lifespan or refreshTime has passed (see this line.) Hence, there is not much difference in setting either one of these as of today. I guess some more complex logic can be potentially implemented having these two values separate.

Gandhi

welcome again and thanks ++1. I would also think the same way you did. I see with default settings lifespan is 15 mins and refreshTime is 5 mins. And the request for jwks update is made only after lifespan expiry period but not after refresh expiry period. This is contrary to what you have said and my own assumption. Any further thoughts. – Hecatomb

Here's small test of the JWKSetCache class which shows that it works exactly as I described. Also, this source line is the check RemoteJWKSet performs to decide if it needs to trigger request to JWKS resource URL. Try to use HttpURLConnection logging to see when exactly requests are triggered. This should make it clear. – Gandhi

i totally agree with you and thanks for the test you have done. I will relook at my observation. – Hecatomb