ReactiveRemoteJWKSource cached JWKSet invalidation

Summary

In NimbusReactiveJwtDecoder there is ReactiveRemoteJWKSource instance created when used with JWK Set URI. I didn't find any way to refresh the cached JWK set in ReactiveRemoteJWKSource. Once it's populated on the very first call to ReactiveRemoteJWKSource.get(JWKSelector jwkSelector) it is not possible to refresh it. Correct me if I'm wrong.

It seems that it was planned to be implemented as there is this comment in the get(JWKSelector jwkSelector, JWKSet jwkSet) method (line 71) but without implementation:

// Refresh the JWK set if the sought key ID is not in the cached JWK set

This issue does not apply to the non-reactive NimbusJwtDecoder which internally uses the original RemoteJWKSet directly from the Nimbus lib. Their implementation at least has the possibility to set cache invalidation timeout (5 mins by default, see com.nimbusds.jose.jwk.source.DefaultJWKSetCache).

Version

5.2.0.RC1

Start at NimbusReactiveJwtDecoder and trace the ReactiveRemoteJWKSource.get(JWKSelector jwkSelector) and get(JWKSelector jwkSelector, JWKSet jwkSet) entry points. Check how the cached JWK set is populated and compare the non-reactive RemoteJWKSet behavior. Done means a missing key ID can trigger a refresh, with tests covering the cached-key and refresh cases.