# Allow overriding the JWKURL expireTime in GraphQL Authorization schema

**URL:** <https://discuss.dgraph.io/t/allow-overriding-the-jwkurl-expiretime-in-graphql-authorization-schema/18154>\
**Category:** GraphQL\
**Created:** [January 5, 2023, 8:28pm UTC](https://discuss.dgraph.io/t/allow-overriding-the-jwkurl-expiretime-in-graphql-authorization-schema/18154 "2023-01-05T20:28:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mattboardman](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/mattboardman/32/10221_2.png) [@mattboardman](https://discuss.dgraph.io/u/mattboardman)\
**Post date:** [January 5, 2023, 8:28pm UTC](https://discuss.dgraph.io/t/allow-overriding-the-jwkurl-expiretime-in-graphql-authorization-schema/18154/1 "2023-01-05T20:28:38Z")

</div>

## Report a GraphQL Bug

The JWKURL refresh is driven by a response header:

```auto
Cache-Control: max-age=$SOME_VALUE

```

code pointer - [dgraph/graphql/authorization/auth.go at c04ce807f9399cc9d00159d54333d7a6a1de18fe · dgraph-io/dgraph · GitHub](https://github.com/dgraph-io/dgraph/blob/c04ce807f9399cc9d00159d54333d7a6a1de18fe/graphql/authorization/auth.go#L492)

In my case the header was returning a dynamic value that was unrelated to the TTL of the key at the JWKURL. I was able to fix the issue on my end since I owned the server in question, but I think it would be wise to add an override so it can be configured from the client side how often Dgraph refreshes the JWK

### What edition and version of Dgraph are you using?

Edition:

- SlashGraphQL
- [x] Dgraph (community edition/Dgraph Cloud)

If you are using the community edition or enterprise edition of Dgraph, please list the version:

> **Dgraph Version**
>
> v22.0.0

### Have you tried reproducing the issue with the latest release?

No

### Steps to reproduce the issue (paste the query/schema if possible)

1. Spin up a Vault server
2. Enable the Identity engine
3. Use the JWK url of the Vault server in your `Authorization` config on a GraphQl schema
4. Wait until the JWK url expires.
5. JWT auth won’t work and will return a JWT unverified error from Dgraph

### Expected behaviour and actual result.

Using the max-age of the Cache-Control seems like an arbitrary decision. I saw that Auth0 uses `max-age=15` but I’m not sure where the value is coming from. I also don’t see it as part of the OIDC standard (but I only searched briefly).