refactor(router): redesign JWK authentication logic

[Noroth]

Motivation and Context

The current implementation for the authentication logic is not optimal. We are creating a token decoder per JWKs while the intention for the library is to have multiple sources where a keyset can be loaded and refreshed from.

This PR introduces a redesign of the current implementation. The configuration changes from a per JWKS basis to a global config with some options per JWKs (e.g. whitelisting algorithms when loading keys)

The token logic has been simplified to use a single token decoder, that can handle all keys and header/valueprefix combinations.

Warning

As part of the preparations for Cosmo V1, targeted for release in Q1 2025, this pull request introduces essential changes to enhance long-term stability and maintainability. While we strive to minimize breaking changes, they are sometimes necessary to lay the foundation for a more robust and scalable system.

Config change example:

Old

New

authentication: providers: - name: "jwk1" jwks: refresh_interval: 1m url: "https://test1.io.well-known/jwks.json" header_value_prefixes: - "Bearer" - "Token" - "MyBearer" header_names: - "Authorization" - "X-Auth-Token" - name: "jwk2" jwks: refresh_interval: 2m url: "https://test2.io/.well-known/jwks.json" header_value_prefixes: - "Bearer" - "Token" - "MyBearer" header_names: - "Authorization" - "X-Auth-Token" - "X-Authorization"

authentication: jwt: jwks: - url: "https://test1.io/.well-known/jwks.json" refresh_interval: 1m # Leaving algorithms empty will allow all supported # algorithms from the config docs - url: "https://test2.io/.well-known/jwks.json" refresh_interval: 2m # optional list of allowed algorithms per JWKS algorithms: ["RS256", "EdDSA", "HS512"] header_name: Authorization # This is the default value header_value_prefix: Bearer # This is the default value # additional header/prefix combinations header_sources: - type: header name: X-Auth-Token value_prefixes: [Token, MyToken] - type: header name: X-Authorization

Checklist

• I have discussed my proposed changes in an issue and have received approval to proceed.
• I have followed the coding standards of the project.
• Tests or benchmarks have been added or updated.
• Documentation has been updated on https://github.com/wundergraph/cosmo-docs.
• I have read the Contributors Guide.

[github-actions]

Router image scan passed

✅ No security vulnerabilities found in image:

ghcr.io/wundergraph/cosmo/router:sha-8e78e803d5cbf7be2786774dad4cffbaaa3d970f

[StarpTech]

Overall great work. Just a few nuts.

[StarpTech]

Please document how the migration will look like and mention that it is breaking.

[StarpTech]

LGTM

[Noroth]

I will prepare the documentation changes before merging this PR