Best practise for jwkSource?

[zhenchuan9r]

Currently, jwkSource is created by host application but not the framework (I mean spring-authorization-server). I would like to ask what is the best practise for jwkSource management?
I wonder if it should be created once and unchanged forever. But I don't quite understand the clients' behaviour if the server changes its key store online.
Any suggestions, or built-in jwkSource management feature will be greatly appreciated.

[sjohnr]

Hi @zhenchuan9r, thanks for getting in touch, but it feels like this is a question that would be better suited to Stack Overflow. We prefer to use GitHub issues only for bugs and enhancements. Feel free to update this issue with a link to the re-posted question (so that other people can find it).

Note that enhancement requests would ideally have more details and be more specific. I'm going to close this for now, but if you have more details you can provide for a feature request, feel free to add those details to this issue and we can re-open if needed.

I would also encourage you to up-vote #544 if you're interested in a guide for performing key rotation, as in the end that may be all you're needing right now. We're currently prioritizing guides for our upcoming reference documentation based on the issues with the most community up-votes.