Add configurable HTTP timeouts for Cloudflare API calls

Introduces connection and read timeout configuration to prevent
indefinite hangs when communicating with Cloudflare's Turnstile API.
This improves resilience by ensuring failed or slow API calls fail
fast rather than blocking indefinitely.

Changes:
- Added connectTimeout and readTimeout properties (default 5s and 10s)
- Configured RestClient with JdkClientHttpRequestFactory for timeout support
- Added timeout configuration to turnstile.properties
- Added startup logging for configured timeout values

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: devondragon

src/main/java/com/digitalsanctuary/cf/turnstile/config/TurnstileConfigProperties.java

@@ -56,6 +56,16 @@ public class TurnstileConfigProperties {
      */
     private String url;
 
+    /**
+     * Connection timeout in seconds. Defaults to 5 seconds.
+     */
+    private int connectTimeout = 5;
+
+    /**
+     * Read timeout in seconds. Defaults to 10 seconds.
+     */
+    private int readTimeout = 10;
+
     /**
      * Configuration for metrics and monitoring.
      */

src/main/java/com/digitalsanctuary/cf/turnstile/config/TurnstileServiceConfig.java

@@ -1,12 +1,15 @@
 package com.digitalsanctuary.cf.turnstile.config;
 
+import java.net.http.HttpClient;
+import java.time.Duration;
 import java.util.Optional;
 import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
+import org.springframework.http.client.JdkClientHttpRequestFactory;
 import org.springframework.web.client.RestClient;
 import com.digitalsanctuary.cf.turnstile.service.TurnstileValidationService;
 import io.micrometer.core.instrument.MeterRegistry;
@@ -45,8 +48,24 @@ public TurnstileValidationService turnstileValidationService(@Qualifier("turnsti
     @Bean(name = "turnstileRestClient")
     public RestClient turnstileRestClient() {
         log.info("Creating Turnstile REST client with endpoint: {}", properties.getUrl());
-        return RestClient.builder().baseUrl(properties.getUrl()).defaultHeader(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
-                .defaultHeader(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON_VALUE).build();
+        log.info("Turnstile REST client timeouts - connect: {}s, read: {}s",
+                properties.getConnectTimeout(), properties.getReadTimeout());
+
+        // Configure HttpClient with timeouts
+        HttpClient httpClient = HttpClient.newBuilder()
+                .connectTimeout(Duration.ofSeconds(properties.getConnectTimeout()))
+                .build();
+
+        // Create request factory with the configured HttpClient
+        JdkClientHttpRequestFactory requestFactory = new JdkClientHttpRequestFactory(httpClient);
+        requestFactory.setReadTimeout(Duration.ofSeconds(properties.getReadTimeout()));
+
+        return RestClient.builder()
+                .baseUrl(properties.getUrl())
+                .requestFactory(requestFactory)
+                .defaultHeader(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
+                .defaultHeader(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON_VALUE)
+                .build();
     }
 
 }

src/main/resources/config/turnstile.properties

@@ -4,6 +4,10 @@ ds.cf.turnstile.sitekey=
 ds.cf.turnstile.secret=
 ds.cf.turnstile.url=https://challenges.cloudflare.com/turnstile/v0/siteverify
 
+# Timeout configuration (in seconds)
+ds.cf.turnstile.connect-timeout=5
+ds.cf.turnstile.read-timeout=10
+
 # Configuration for TurnstileCaptchaFilter component (for use with Spring Security Form Login, etc...)
 ds.cf.turnstile.login.submissionPath=/login
 ds.cf.turnstile.login.redirectUrl=/login?error=captcha