Great catch, you're right. In the jku/x5u article I really did focus on SSRF via HTTP(S) and cloud metadata, but I skipped file:// and other schemes, even though it's a classic. If the server uses a universal URL loader (Java URL/URLConnection, Python urllib.urlopen, PHP streams with allow_url_fopen), then jku: "file:/// etc/passwd" or x5u: "file:/// proc/self/environ" turn into clean LFI right through the JWKS parser. And what's especially interesting, this often bypasses the host whitelist, because the scheme is different and there's no host at all. Thanks for the feedback, and it's awesome that you actually read the stuff instead of just bookmarking it! ❤️ I'll add these things as a "P.S." when I'm putting out the next series of articles.