From 3d5d119f9c679aa3af6aca82370c0310e2218a9c Mon Sep 17 00:00:00 2001 From: Ralph Bragg Date: Fri, 24 Jul 2026 12:48:43 +1000 Subject: [PATCH] Ignore unsupported kty when a Set is built from an array (RFC 7517 Section 5) The Hash constructor already skips keys whose kty is unrecognised (#728), but the Array constructor did not, so JWT::JWK::Set.new([...]) still failed the whole set on one unknown key. Mirror the Hash path so both are tolerant. --- lib/jwt/jwk/set.rb | 6 +++++- spec/jwt/jwk/set_spec.rb | 10 ++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/lib/jwt/jwk/set.rb b/lib/jwt/jwk/set.rb index 2a11aee5..4c611591 100644 --- a/lib/jwt/jwk/set.rb +++ b/lib/jwt/jwk/set.rb @@ -28,7 +28,11 @@ def initialize(jwks = nil, options = {}) # rubocop:disable Metrics/CyclomaticCom nil end when Array - jwks.map { |k| JWT::JWK.new(k, nil, options) } + jwks.each_with_object([]) do |k, arr| + arr << JWT::JWK.new(k, nil, options) + rescue JWT::UnsupportedKeyType + nil + end else raise ArgumentError, 'Can only create new JWKS from Hash, Array and JWK' end diff --git a/spec/jwt/jwk/set_spec.rb b/spec/jwt/jwk/set_spec.rb index 4678db08..c100b139 100644 --- a/spec/jwt/jwk/set_spec.rb +++ b/spec/jwt/jwk/set_spec.rb @@ -48,6 +48,16 @@ expect(set.keys[0][:kty]).to eql('oct') end + it 'ignores keys with unsupported kty values when constructed from an array (RFC 7517 ยง5)' do + keys = [ + { kty: 'unknown', alg: 'unknown-alg', kid: 'unknown' }, + { kty: 'oct', k: Base64.strict_encode64('testkey') } + ] + set = described_class.new(keys) + expect(set.size).to eql(1) + expect(set.keys[0][:kty]).to eql('oct') + end + it 'returns an empty set when all keys have unsupported kty values' do jwks = { keys: [