Align NimbusJwtDecoder HTTP timeout defaults with Nimbus by setting to 500ms

[frido37]

Summary
This change proposes a potential fix for spring-security#15866, which we encountered in a production environment.

Problem
We experienced a critical "stop-the-world" event lasting approximately 15 minutes due to the absence of connection and read timeouts in the default RestTemplate configuration used by NimbusJwtDecoder. Specifically, the underlying SimpleClientHttpRequestFactory does not define any timeouts, which can cause the application to hang indefinitely in certain network failure scenarios.

Current Workaround
To mitigate this in our own application, we use a JwkSetUriJwtDecoderBuilderCustomizer to configure the RestTemplate with appropriate timeouts. While this works, the current default behavior is problematic and may impact other users as well.

@Configuration
public class JwtDecoderConfig {

    @Bean
    public JwkSetUriJwtDecoderBuilderCustomizer jwkSetUriJwtDecoderBuilderCustomizer() {
        return builder -> {
            SimpleClientHttpRequestFactory requestFactory = new SimpleClientHttpRequestFactory();
            requestFactory.setConnectTimeout(RemoteJWKSet.DEFAULT_HTTP_CONNECT_TIMEOUT);
            requestFactory.setReadTimeout(RemoteJWKSet.DEFAULT_HTTP_READ_TIMEOUT);

            builder.restOperations(new RestTemplate(requestFactory));
        };
    }
}

Proposal
We suggest that reasonable default timeouts (both connect and read) should be applied to the RestTemplate used by default in NimbusJwtDecoder. This change will help prevent similar problems for others.

[jzheaux]

Thanks, @frido37, for the PR! I've left some feedback inline.

[jzheaux]

This is a note for myself:

As part of merging, upgrade instructions should be added to the 6.5 guide for how to update an application's configuration to use the new timeout values. In this way, they can know whether the new timeouts will be an issue before updating to 7.0.

[frido37]

Thanks for the feedback. I Resolved it with the second commit.

[jzheaux]

Thanks, @frido37. Will you please squash your commits and then we can merge it?

In the future, if you publish a PR on a branch instead of main, I can help a bit more with cleanups like that.

Please also change your commit to the following title and description:

Provider Default Timeouts For JWK Retrieval

Issue gh-14269

[frido37]

I’ve squashed the commits and updated the commit message. Let me know if anything else is needed.