Any advice accessing services with an AWS VPC?

[BioSurienDG]

Currently if I do

jose.createRemoteJWKSet(new URL(`${BaseURL}/oidc/jwks`)

it fails when used with the verify function if the JWKs route is available only within a VPC (and I'm making the call from a service within the same VPC). The failure gives the following error: Expected 200 OK from the JSON Web Key Set HTTP response

If I use fetch to make the same get request from the same node js service it succeeds.

const result = await fetch(new URL(`${BaseURL}/oidc/jwks`))
                .then((res) => {
                    if (res.ok) {
                        return res.json();
                    }
                    throw new Error(`Failed to fetch JWKS: ${res.statusText}`);
                })
                .catch((err) => {
                    throw new Error(`Failed to fetch JWKS: ${err.message}`);
                });

[panva]

Assuming your fetch is the global one available in the runtime there's no reason for the behaviour to be any different.

[BioSurienDG]

Ya I'm using the default fetch client included with v18.17.0 when I use that it returns the keyset but the keyset returned by jose.createRemoteJWKSet continually throws Expected 200 OK from the JSON Web Key Set HTTP response. Very odd 🤔 .

Any reason why you used https.get in the library instead of fetch? https://github.com/panva/jose/blob/main/src/runtime/node/fetch_jwks.ts

[panva]

A couple reasons actually

1. when this module was created there was no global fetch in Node.js
2. to this day in the LTS versions of Node.js the fetch API is marked as experimental
3. continuity, I didn't want to swap https for fetch in v5.x because it wasn't meant to be super breaking and users may already have global https agent settings that work for them which wouldn't work for fetch

[BioSurienDG]

@panva Thanks for your help. Seems like we just had to add the UserAgent header - fetch adds a default one implicitly

[panva]

Interesting. I'll do a quick fix for this...

[BioSurienDG]

This is where it adds the default header in fetch: https://github.com/node-fetch/node-fetch/blob/8b3320d2a7c07bce4afc6b2bf6c3bbddda85b01f/src/request.js#L278

[panva]

node-fetch is not the fetch implementation bundled with Node.js, for the record that would be nodejs/undici and it is kind of irrelevant for my intended fix to your problem.

v5.0.2 (when released) will simply add a default user-agent header in non-browser requirements to get around http(s) proxies that block traffic without a user-agent header, it's not the first time i'm encountering this problem.