Harden JWKS URL construction to avoid malformed endpoints

cyrossignol · cyrossignol · commit 29168d1f4c3a · 2026-03-05T11:36:50.000-08:00
diff --git a/api/core/jwt.py b/api/core/jwt.py
@@ -11,8 +11,8 @@ def _get_jwks_client() -> jwt.PyJWKClient:
 
     if _jwks_client is None:
         _jwks_client = jwt.PyJWKClient(
-            f"{settings.TDEI_OIDC_URL}realms/{settings.TDEI_OIDC_REALM}"
-            f"/protocol/openid-connect/certs"
+            f"{settings.TDEI_OIDC_URL.rstrip("/")}/realms/"
+            f"{settings.TDEI_OIDC_REALM}/protocol/openid-connect/certs"
         )
 
     return _jwks_client

Original file line number	Diff line number	Diff line change
`@@ -11,8 +11,8 @@ def _get_jwks_client() -> jwt.PyJWKClient:`
`11`	`11`
`12`	`12`	`if _jwks_client is None:`
`13`	`13`	`_jwks_client = jwt.PyJWKClient(`
`14`		`- f"{settings.TDEI_OIDC_URL}realms/{settings.TDEI_OIDC_REALM}"`
`15`		`- f"/protocol/openid-connect/certs"`
	`14`	`+ f"{settings.TDEI_OIDC_URL.rstrip("/")}/realms/"`
	`15`	`+ f"{settings.TDEI_OIDC_REALM}/protocol/openid-connect/certs"`
`16`	`16`	`)`
`17`	`17`
`18`	`18`	`return _jwks_client`