Better Auth JWKS Cookie Cache

Better Auth 1.7 session cookie cache signed with the jwt() plugin's asymmetric keyring instead of the server secret, so an edge worker or a separate service can verify a session from the public JWKS with no database round trip and no ability to mint sessions. Includes the betterAuth() config (strategy "jwt", signingKey "jwt-plugin", secure cookie prefix, boot-time secret check) and an edge reader that fetches and TTL-caches the JWKS, pins the issuer and audience claims, serves a stale keyring through auth-server blips, and documents the revocation lag the cookie cache carries.

Install

npx shadcn@latest add https://ui.aryank.space/r/better-auth-jwks-cookie-cache.json

Installs from ui.aryank.space. To add it by hand, copy the files in Files below, or register the @compronents namespace via the docs.

Visualization

key lookup

fetch jwks

unknown

verify

unknown


const jwks = await fetch("/api/auth/jwks") // every single request

Every request that verifies a JWT first fetches the JWKS over the network, so the auth server sits in the hot path of every page load. Auth added a round trip to everything, and when the auth server blips, every verify blips with it.

Files

Dependencies

[email protected][email protected]

src

better-auth-jwks-cookie-cache