Repository: symfony/symfony
File: src/Symfony/Component/Security/Http/AccessToken/Oidc/OidcTokenHandler.php (PHP)

Code before:
        if ($this->discoveryClients) {
            $json = $this->discoveryCache->get($this->oidcJWKSetCacheKey, function (): string {
               try {
                   $configResponses = [];
                   foreach ($this->discoveryClients as $discoveryClient) {
                       $configResponses[] = $discoveryClient->request('GET', '.well-known/openid-configuration');
                   }

                   $jwkSetResponses = [];
                   foreach ($discoveryClient->stream($configResponses) as $response => $chunk) {
                       if (! $chunk->isLast()) {
                           continue;
                       }

                       $oidcConfiguration = $response->toArray();
                       $jwkSetResponses[] = $discoveryClient->request('GET', $oidcConfiguration['jwks_uri']);
                   }

                   $keys = [];
                   foreach ($jwkSetResponses as $response) {
                       foreach ($response->toArray()['keys'] as $key) {
                           if ('sig' !== $key['use']) {
                               continue;
                           }

                           $keys[] = $key;
                       }
                   }
               } catch (\Exception $e) {
                    $this->logger?->error('An error occurred while requesting OIDC certs.', [
                        'error' => $e->getMessage(),
                        'trace' => $e->getTraceAsString(),
                    ]);

                    throw new BadCredentialsException('Invalid credentials.', $e->getCode(), $e);
                }

                return \json_encode(['keys' => $keys], \JSON_THROW_ON_ERROR);
            });

            $jwkset = JWKSet::createFromJson($json);
        }

        try {
            $accessToken = $this->decryptIfNeeded($accessToken);
            $claims = $this->loadAndVerifyJws($accessToken, $jwkset);
            $this->verifyClaims($claims);

            if (empty($claims[$this->claim])) {
                throw new MissingClaimException(\sprintf('"%s" claim not found.', $this->claim));
            }

Review comment (suggestion):
```suggestion
                       if ($chunk->isLast()) {
                           $jwkSetResponses[] = $discoveryClient->request('GET', $response->toArray()['jwks_uri']);
                       }
                   }

                   $keys = [];
                   foreach ($jwkSetResponses as $response) {
                       foreach ($response->toArray()['keys'] as $key) {
                           if ('sig' === $key['use']) {
                               $keys[] = $key;
                           }
```

Code after:

        $jwkset = $this->signatureKeyset;
        if ($this->discoveryClients) {
            $clients = $this->discoveryClients;
            $logger = $this->logger;
            $keys = $this->discoveryCache->get($this->oidcConfigurationCacheKey, static function () use ($clients, $logger): array {
                try {
                    $configResponses = [];
                    foreach ($clients as $client) {
                        $configResponses[] = $client->request('GET', '.well-known/openid-configuration', [
                            'user_data' => $client,
                        ]);
                    }

                    $jwkSetResponses = [];
                    foreach ($client->stream($configResponses) as $response => $chunk) {
                        if ($chunk->isLast()) {
                            $jwkSetResponses[] = $response->getInfo('user_data')->request('GET', $response->toArray()['jwks_uri']);
                        }
                    }

                    $keys = [];
                    foreach ($jwkSetResponses as $response) {
                        foreach ($response->toArray()['keys'] as $key) {
                            if ('sig' === $key['use']) {
                                $keys[] = $key;
                            }
                        }
                    }

                    return $keys;
                } catch (\Exception $e) {
                    $logger?->error('An error occurred while requesting OIDC certs.', [
                        'error' => $e->getMessage(),
                        'trace' => $e->getTraceAsString(),
                    ]);

                    throw new BadCredentialsException('Invalid credentials.', $e->getCode(), $e);
                }
            });

            $jwkset = JWKSet::createFromKeyData(['keys' => $keys]);
        }

        try {
            $accessToken = $this->decryptIfNeeded($accessToken);
            $claims = $this->loadAndVerifyJws($accessToken, $jwkset);
            $this->verifyClaims($claims);

            if (empty($claims[$this->claim])) {
                throw new MissingClaimException(\sprintf('"%s" claim not found.', $this->claim));