Spring Boot集成Auth0校验JWT时如何自定义JWKS获取端点

开发Spring Boot应用集成Auth0组件做接口JWT合法性校验时，运行抛出错误：JWKS key info not found at well-known endpoint。
经排查，问题根因为对接方的JWKS密钥信息直接部署在目标URL根路径，未遵循OIDC标准将JWKS服务放在/.well-known/jwks.json路径下。
当前使用的校验实现代码如下：

DecodedJWT jwt = JWT.decode(jwt);
JwkProvider provider = new UrlJwkProvider(new URL(configProperties.getKeyUrl()), 5000, 2000);
Jwk jwk = provider.get(jwt.getKeyId());

查阅对应类库的Javadoc确认：UrlJwkProvider无论传入什么URL参数，都会自动在地址后追加/.well-known/jwks.json后缀，无法直接对接现有非标准路径的JWKS端点，需要找到适配自定义JWKS拉取地址的方案，或可替代的实现类库。

方案1：扩展Auth0原生JwkProvider，跳过固定路径拼接 #

不需要替换现有依赖，直接实现JwkProvider接口自定义拉取逻辑即可，核心是跳过组件默认的well-known路径拼接规则，直接请求传入的自定义URL获取JWKS内容，同时保留缓存能力避免重复请求远程接口：

public class CustomUrlJwkProvider implements JwkProvider {
    private final URL fullJwksUrl;
    private final int connectTimeout;
    private final int readTimeout;
    private final LoadingCache<String, Jwk> jwkCache;

    public CustomUrlJwkProvider(URL fullJwksUrl, int connectTimeout, int readTimeout) {
        this.fullJwksUrl = fullJwksUrl;
        this.connectTimeout = connectTimeout;
        this.readTimeout = readTimeout;
        // 配置本地缓存，可根据密钥轮换周期调整过期时间
        this.jwkCache = CacheBuilder.newBuilder()
                .expireAfterWrite(1, TimeUnit.HOURS)
                .maximumSize(10)
                .build(new CacheLoader<String, Jwk>() {
                    @Override
                    public Jwk load(String kid) throws Exception {
                        return loadJwkFromRemote(kid);
                    }
                });
    }

    @Override
    public Jwk get(String kid) throws JwkException {
        try {
            return jwkCache.get(kid);
        } catch (ExecutionException e) {
            throw new SigningKeyNotFoundException("从自定义JWKS端点获取密钥失败", e.getCause());
        }
    }

    private Jwk loadJwkFromRemote(String targetKid) throws IOException, JwkException {
        HttpURLConnection connection = (HttpURLConnection) fullJwksUrl.openConnection();
        connection.setConnectTimeout(connectTimeout);
        connection.setReadTimeout(readTimeout);
        connection.setRequestMethod("GET");
        connection.setRequestProperty("Accept", "application/json");

        if (connection.getResponseCode() != 200) {
            throw new IOException("请求JWKS端点异常，响应码：" + connection.getResponseCode());
        }

        String response = new String(connection.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
        JwkSet jwkSet = JwkSet.fromJson(response);
        return jwkSet.getKeys().stream()
                .filter(jwk -> targetKid.equals(jwk.getId()))
                .findFirst()
                .orElseThrow(() -> new SigningKeyNotFoundException("JWKS响应中无匹配kid的密钥", null));
    }
}

使用时直接替换原有UrlJwkProvider实例即可，传入的URL不会被追加任何后缀：

DecodedJWT jwt = JWT.decode(jwt);
JwkProvider provider = new CustomUrlJwkProvider(new URL(configProperties.getKeyUrl()), 5000, 2000);
Jwk jwk = provider.get(jwt.getKeyId());

方案2：换用Nimbus JOSE JWT类库实现 #

如果不想自定义实现逻辑，可以直接换用Nimbus JOSE + JWT库，该类库默认支持传入任意JWKS完整路径，不会强制拼接well-known后缀，且自带密钥缓存、轮换自动刷新、超时配置等生产级能力。如果项目已经引入spring-boot-starter-oauth2-resource-server依赖，该库会被自动引入，不需要额外添加依赖。
核心实现代码：

// 直接传入自定义的JWKS完整URL，无额外路径拼接
JWKSource<SecurityContext> jwkSource = new RemoteJWKSet<>(new URL(configProperties.getKeyUrl()));
ConfigurableJWTProcessor<SecurityContext> jwtProcessor = new DefaultJWTProcessor<>();
// 指定实际使用的JWT签名算法
JWSKeySelector<SecurityContext> keySelector = new JWSVerificationKeySelector<>(
        JWSAlgorithm.RS256,
        jwkSource
);
jwtProcessor.setJWSKeySelector(keySelector);
// 完成JWT校验与解析
JWTClaimsSet claims = jwtProcessor.process(jwtValue, null);

内容的提问来源于stack exchange，提问作者aatuc210