NimbusJwtDecoder failing with Read timed out issue in fetchJwks method

[napa-email]

Describe the bug
NimbusJwtDecoder failing with Read timed out issue in fetchJwks method. It happens after spring boot upgrade from 3.5.3 to 4.0.6.

To Reproduce
It is very intermittent issue and it occurs only in AWS environment. It is not happening in local machine.
If i deploy the older version of code in aws, it works fine without any error.

Environment
Spring Boot: 4.0.6
Spring Security: 7.0.5
Java: 17
Identity Provider: Okta

Stacktrace
java.net.SocketTimeoutException: Read timed out
..........
at org.springframework.http.client.AbstractClientHttpRequest.execute(AbstractClientHttpRequest.java:80)
at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:754)
at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:619)
at org.springframework.security.oauth2.jwt.NimbusJwtDecoder$JwkSetUriJwtDecoderBuilder$SpringJWKSource.fetchJwks(NimbusJwtDecoder.java:530)
at org.springframework.cache.support.NoOpCache.get(NoOpCache.java:76)
at org.springframework.security.oauth2.jwt.NimbusJwtDecoder$JwkSetUriJwtDecoderBuilder$SpringJWKSource.getJWKSet(NimbusJwtDecoder.java:544)
.......
at com.nimbusds.jose.jwk.source.CachingJWKSetSource.loadJWKSetNotThreadSafe(CachingJWKSetSource.java:330)
.....
at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.createJwt(NimbusJwtDecoder.java:164)
at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.decode(NimbusJwtDecoder.java:144)
at org.springframework.security.oauth2.client.oidc.authentication.OidcAuthorizationCodeAuthenticationProvider.getJwt(OidcAuthorizationCodeAuthenticationProvider.java:247)
at org.springframework.security.oauth2.client.oidc.authentication.OidcAuthorizationCodeAuthenticationProvider.createOidcToken(OidcAuthorizationCodeAuthenticationProvider.java:238)
at org.springframework.security.oauth2.client.oidc.authentication.OidcAuthorizationCodeAuthenticationProvider.authenticate(OidcAuthorizationCodeAuthenticationProvider.java:156)
at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:183)

Investigation

Read and Connection timeout value was hardcoded in NimbusJwtDecoder class (RestTemplateWithNimbusDefaultTimeouts), tried to override this value using below method but it didnt help
@bean
JwtDecoder jwtDecoder(OAuth2ResourceServerProperties properties) {

SimpleClientHttpRequestFactory factory =
        new SimpleClientHttpRequestFactory();

factory.setConnectTimeout(10000);
factory.setReadTimeout(10000);

RestTemplate restTemplate = new RestTemplate(factory);

return NimbusJwtDecoder
        .withIssuerLocation(properties.getJwt().getIssuerUri())
        .restOperations(restTemplate)
        .build();

}

In debug mode, still RestTemplate is showing 500ms timeout value.

Question
Is this expected behavior?
Is there any other way to override this value?

Thank you for your time.

[xdushan]

I experienced the same issue with Spring Boot 4.1.0. It was caused by the 500 ms read timeout configured in the RestTemplateWithNimbusDefaultTimeouts() method in NimbusJwtDecoder class .

I resolved it by defining a custom JwtDecoder bean with longer connection and read timeouts:

@Bean
public JwtDecoder jwtDecoder(
        RestTemplateBuilder builder,
        JwtProperties properties
) {
    RestOperations restTemplate = builder
            .connectTimeout(Duration.ofSeconds(1))
            .readTimeout(Duration.ofSeconds(1))
            .build();

    NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder
            .withIssuerLocation(properties.issuerUri())
            .restOperations(restTemplate)
            .build();

    OAuth2TokenValidator<Jwt> issuerValidator =
            JwtValidators.createDefaultWithIssuer(properties.issuerUri());

    OAuth2TokenValidator<Jwt> audienceValidator =
            new JwtClaimValidator<List<String>>(
                    "aud",
                    tokenAudiences -> tokenAudiences.stream()
                            .anyMatch(properties.audiences()::contains)
            );

    jwtDecoder.setJwtValidator(
            new DelegatingOAuth2TokenValidator<>(
                    issuerValidator,
                    audienceValidator
            )
    );

    return jwtDecoder;
}

@ConfigurationProperties(
        prefix = "spring.security.oauth2.resourceserver.jwt"
)
public record JwtProperties(
        String issuerUri,
        List<String> audiences
) {
    public JwtProperties {
        audiences = audiences == null
                ? List.of()
                : List.copyOf(audiences);
    }
}

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: ${JWT_ISSUER}
          audiences:
            - ${TEST_AUDIENCE}