Re: [keycloak-user] discovery and key security

Those endpoints shouldn't contain any sensitive data. There are not "signing keys" itself, there are just public keys, which client applications can download, so they are able to verify access token. Also endpoint locations provided by .well-known are public, but the endpoints itself (eg. token endpoint) are properly secured. It's per OpenID Connect Discovery that endpoint doesn't need to be secured. It's just needed that endpoint use HTTPS to avoid man-in-the-middle attacks when attacker would trick the client application by return incorrect endpoints or public keys. Do you see anything concrete where exposing those information is security risk? Thanks, Marek On 10/08/17 11:18, Simon Payne wrote: