|
42 | 42 | import com.nimbusds.jose.jwk.source.JWKSetSource; |
43 | 43 | import com.nimbusds.jose.jwk.source.JWKSource; |
44 | 44 | import com.nimbusds.jose.jwk.source.JWKSourceBuilder; |
| 45 | +import com.nimbusds.jose.jwk.source.RemoteJWKSet; |
45 | 46 | import com.nimbusds.jose.proc.DefaultJOSEObjectTypeVerifier; |
46 | 47 | import com.nimbusds.jose.proc.JOSEObjectTypeVerifier; |
47 | 48 | import com.nimbusds.jose.proc.JWSKeySelector; |
|
66 | 67 | import org.springframework.http.MediaType; |
67 | 68 | import org.springframework.http.RequestEntity; |
68 | 69 | import org.springframework.http.ResponseEntity; |
| 70 | +import org.springframework.http.client.SimpleClientHttpRequestFactory; |
69 | 71 | import org.springframework.security.oauth2.core.OAuth2Error; |
70 | 72 | import org.springframework.security.oauth2.core.OAuth2TokenValidator; |
71 | 73 | import org.springframework.security.oauth2.core.OAuth2TokenValidatorResult; |
@@ -293,7 +295,7 @@ public static final class JwkSetUriJwtDecoderBuilder { |
293 | 295 |
|
294 | 296 | private final Set<SignatureAlgorithm> signatureAlgorithms = new HashSet<>(); |
295 | 297 |
|
296 | | - private RestOperations restOperations = new RestTemplate(); |
| 298 | + private RestOperations restOperations = new RestTemplateWithTimeouts(); |
297 | 299 |
|
298 | 300 | private Cache cache = new NoOpCache("default"); |
299 | 301 |
|
@@ -545,6 +547,21 @@ public void close() { |
545 | 547 |
|
546 | 548 | } |
547 | 549 |
|
| 550 | + /** |
| 551 | + * A RestTemplate with timeouts configured to avoid blocking indefinitely when |
| 552 | + * fetching JWK Sets while holding the reentrantLock. |
| 553 | + */ |
| 554 | + private static final class RestTemplateWithTimeouts extends RestTemplate { |
| 555 | + |
| 556 | + private RestTemplateWithTimeouts () { |
| 557 | + SimpleClientHttpRequestFactory requestFactory = new SimpleClientHttpRequestFactory(); |
| 558 | + requestFactory.setConnectTimeout(RemoteJWKSet.DEFAULT_HTTP_CONNECT_TIMEOUT); |
| 559 | + requestFactory.setReadTimeout(RemoteJWKSet.DEFAULT_HTTP_READ_TIMEOUT); |
| 560 | + setRequestFactory(requestFactory); |
| 561 | + } |
| 562 | + |
| 563 | + } |
| 564 | + |
548 | 565 | /** |
549 | 566 | * A builder for creating {@link NimbusJwtDecoder} instances based on a public key. |
550 | 567 | */ |
|
0 commit comments