From 0ce9d27af21d44d15136f331fc05ab6dc2b6a753 Mon Sep 17 00:00:00 2001 From: Fridolin Jackstadt Date: Sat, 23 Aug 2025 15:03:04 +0200 Subject: [PATCH] Provider Default Timeouts For JWK Retrieval Issue gh-14269 Signed-off-by: Fridolin Jackstadt --- .../security/oauth2/jwt/NimbusJwtDecoder.java | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/NimbusJwtDecoder.java b/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/NimbusJwtDecoder.java index b5652e9fc9e..d0bcfda49bf 100644 --- a/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/NimbusJwtDecoder.java +++ b/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/NimbusJwtDecoder.java @@ -66,6 +66,7 @@ import org.springframework.http.MediaType; import org.springframework.http.RequestEntity; import org.springframework.http.ResponseEntity; +import org.springframework.http.client.SimpleClientHttpRequestFactory; import org.springframework.security.oauth2.core.OAuth2Error; import org.springframework.security.oauth2.core.OAuth2TokenValidator; import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult; @@ -293,7 +294,7 @@ public static final class JwkSetUriJwtDecoderBuilder { private final Set signatureAlgorithms = new HashSet<>(); - private RestOperations restOperations = new RestTemplate(); + private RestOperations restOperations = new RestTemplateWithNimbusDefaultTimeouts(); private Cache cache = new NoOpCache("default"); @@ -545,6 +546,21 @@ public void close() { } + /** + * A RestTemplate with timeouts configured to avoid blocking indefinitely when + * fetching JWK Sets while holding the reentrantLock. + */ + private static final class RestTemplateWithNimbusDefaultTimeouts extends RestTemplate { + + private RestTemplateWithNimbusDefaultTimeouts() { + SimpleClientHttpRequestFactory requestFactory = new SimpleClientHttpRequestFactory(); + requestFactory.setConnectTimeout(JWKSourceBuilder.DEFAULT_HTTP_CONNECT_TIMEOUT); + requestFactory.setReadTimeout(JWKSourceBuilder.DEFAULT_HTTP_READ_TIMEOUT); + setRequestFactory(requestFactory); + } + + } + /** * A builder for creating {@link NimbusJwtDecoder} instances based on a public key. */