diff --git a/lib/jwt/jwk/set.rb b/lib/jwt/jwk/set.rb index 2a11aee5..4c611591 100644 --- a/lib/jwt/jwk/set.rb +++ b/lib/jwt/jwk/set.rb @@ -28,7 +28,11 @@ def initialize(jwks = nil, options = {}) # rubocop:disable Metrics/CyclomaticCom nil end when Array - jwks.map { |k| JWT::JWK.new(k, nil, options) } + jwks.each_with_object([]) do |k, arr| + arr << JWT::JWK.new(k, nil, options) + rescue JWT::UnsupportedKeyType + nil + end else raise ArgumentError, 'Can only create new JWKS from Hash, Array and JWK' end diff --git a/spec/jwt/jwk/set_spec.rb b/spec/jwt/jwk/set_spec.rb index 4678db08..c100b139 100644 --- a/spec/jwt/jwk/set_spec.rb +++ b/spec/jwt/jwk/set_spec.rb @@ -48,6 +48,16 @@ expect(set.keys[0][:kty]).to eql('oct') end + it 'ignores keys with unsupported kty values when constructed from an array (RFC 7517 ยง5)' do + keys = [ + { kty: 'unknown', alg: 'unknown-alg', kid: 'unknown' }, + { kty: 'oct', k: Base64.strict_encode64('testkey') } + ] + set = described_class.new(keys) + expect(set.size).to eql(1) + expect(set.keys[0][:kty]).to eql('oct') + end + it 'returns an empty set when all keys have unsupported kty values' do jwks = { keys: [