security: JWKS URL config lacks SSRF protection (only OIDC discovery is validated)

[nfvelten]

Migrated from nfvelten/arbitus#122

Summary

src/jwt.rs validates issuer URLs against SSRF patterns (non-HTTPS, localhost, private IPs, link-local ranges) before making outbound requests. However, a directly configured JWKS URL bypasses this validation entirely. A malicious config could point JWKS to an internal service.

Distinction from #56

Issue #56 tracks JWKS cache expiration (stale keys after rotation). This issue tracks SSRF via the JWKS fetch URL itself — a different, unrelated code path.

Location

src/jwt.rs — JWKS URL is fetched via reqwest without the validate_issuer_url() check that applies to OIDC discovery.

Fix

Apply the same URL validation (validate_issuer_url) to direct JWKS URL configuration before any outbound HTTP request.

References

• PROPOSAL.md §3.9