2

Spring security documentation https://docs.spring.io/spring-security/reference/servlet/oauth2/resource-server/jwt.html#oauth2resourceserver-jwt-timeouts states that:

By default, Resource Server uses connection and socket timeouts of 30 seconds each for coordinating with the authorization server.

I created JwtDecoder in the following way:

@Bean
JwtDecoder jwtDecoder() {
    NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri).build();
    return jwtDecoder;
}

jwkSetUri is set to some non-existent ip. Now, making request to my resource server gets a timeout (as expected) and the following exception is thrown:

An error occurred while attempting to decode the Jwt: Couldn't retrieve remote JWK set: org.springframework.web.client.ResourceAccessException: I/O error on GET request: Connect to jwkSetUri  [jwkSetUri ] failed: connect timed out; nested exception is org.apache.http.conn.ConnectTimeoutException: Connect to jwkSetUri  failed: connect timed out

However, the time after which the exception is thrown does not match what is described in the documentation. When I run the application on windows, it takes about 20 seconds. When I run on Linux, it takes about 2-3 minutes. It looks like it depends on the operating system. However, when I manually set the timeout as follows:

@Bean
public JwtDecoder jwtDecoder(RestTemplateBuilder builder) {
    RestOperations rest = builder
            .setConnectTimeout(Duration.ofSeconds(5))
            .setReadTimeout(Duration.ofSeconds(5))
            .build();

    NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri).restOperations(rest).build();
    return jwtDecoder;
}

Then as expected I get a timeout after 5 seconds. Am I missing something or the default value given in the documentation is incorrect?

Piotrold
  • 77
  • 1
  • 6

0 Answers0