last-modified headers on .well-known endpoints.

[jerryhopper]

last-modified headers on .well-known endpoints.

Problem

When something in the configuration changes on fusionauth, the .well-known discovery-endpoints reflect new information. caching these file is being done by the requesting party - which can lead to serving outdated discovery information

Solution

Add last-modified headers on the ./well-known endpoints

Additional Details

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Last-Modified
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag

Related:

• Enable configurable caching of the .well-known endpoints #2372

Alternatives/workarounds

the requesting party should refresh the discovery data in cache more often.

[robotdan]

Thanks for opening the issue @jerryhopper.

This is something we should add.

For reference, for the OpenID Connect Configuration discovery document - the only part of that configuration that is based upon user configuration is the issuer which is the value in the default tenant unless a Tenant Id is provided on the request, in which case it will be the value from that tenant.

For the JWKS endpoint, this one may be trickier to come up with the correct last modified value, but we can take a look. The content of the key set depends upon JWT signing configuration. We do know the last time an application or tenant has been modified, but we don't track when the signing configuration was last modified. So we could just add the Last Modified header equal to the last modified instant of the most recently changed participating applications.