Skip to content

fix: replace hard-coded JWKS timeouts#18563

Open
knoobie wants to merge 1 commit intospring-projects:mainfrom
knoobie:patch-1
Open

fix: replace hard-coded JWKS timeouts#18563
knoobie wants to merge 1 commit intospring-projects:mainfrom
knoobie:patch-1

Conversation

@knoobie
Copy link

@knoobie knoobie commented Jan 23, 2026

Replace the hard-coded 500ms connect- and read-timeouts for the jwks request to use the recommended method that evaluates the system property to lower or increase the timeouts.

Replace the hard-coded 500ms connect- and read-timeouts for the jwks request to use the recommended method that evaluates the system property to lower or increase the timeouts.

Signed-off-by: Knoobie <Knoobie@gmx.de>
@knoobie knoobie changed the title fix: replace hard-coded JWT timeouts fix: replace hard-coded JWKS timeouts Jan 23, 2026
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Jan 23, 2026
SimpleClientHttpRequestFactory requestFactory = new SimpleClientHttpRequestFactory();
requestFactory.setConnectTimeout(JWKSourceBuilder.DEFAULT_HTTP_CONNECT_TIMEOUT);
requestFactory.setReadTimeout(JWKSourceBuilder.DEFAULT_HTTP_READ_TIMEOUT);
requestFactory.setConnectTimeout(RemoteJWKSet.resolveDefaultHTTPConnectTimeout());
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd prefer to not go from a non-deprecated to a deprecated API. I've added https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/614 to see what the recommended approach is.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: waiting-for-triage An issue we've not yet triaged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants