test: remove live Google JWKS call from JwtBearerTokenTest (2.42)#24487
Merged
Conversation
JwtBearerTokenTest.testExpiredToken cleared the local JwtDecoder and replayed a real (long-expired) Google id_token, forcing JwtDecoders.fromIssuerLocation to perform live OIDC discovery and a JWKS fetch of https://www.googleapis.com/oauth2/v3/certs on every CI run. Any egress blip failed the build (RemoteKeySourceException). Rewrite the test to run fully offline using the existing local RSA fixtures: testExpiredToken now mints a locally-signed token with a fixed past exp and asserts the actual expiry error, and a new testUnknownSigningKey preserves the original intent (token signed with a key/algorithm the server does not accept) by signing with RS384 against the RS256 decoder, asserting the same error message the old test relied on Google's key rotation to produce. The unused Google token, client id and provider setup are removed. Test-only change; no production code affected.
|
jbee
approved these changes
Jul 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #24486 to this line.
Summary
JwtBearerTokenTest.testExpiredTokencleared the localJwtDecoderand replayed a real (long-expired) Google id_token, forcingJwtDecoders.fromIssuerLocationto perform live OIDC discovery plus a JWKS fetch ofhttps://www.googleapis.com/oauth2/v3/certson every CI run. Any egress blip failed the build:External requests do not belong in the automated CI build.
What changed (test-only)
testExpiredTokennow mints a locally-signed token with a fixed pastexpand asserts the actual expiry error (Jwt expired at …). Previously the asserted message was a key-not-found error caused by Google having long rotated the 2021 signing key out of its JWKS — token expiry was never actually exercised.testUnknownSigningKeypreserves the original intent (a token signed with a key the server no longer accepts, e.g. ephemeral signing keys after a restart) fully offline: an RS384-signed token against the RS256 local decoder produces the same error message the old test relied on Google's key rotation to trigger.No production code affected.
Verification
I/O error on GET request for "https://accounts.google.com/.well-known/openid-configuration").AI Assisted