Summary
This change proposes a potential fix for spring-security#15866, which we encountered in a production environment.

Problem
We experienced a critical "stop-the-world" event lasting approximately 15 minutes due to the absence of connection and read timeouts in the default RestTemplate configuration used by NimbusJwtDecoder. Specifically, the underlying SimpleClientHttpRequestFactory does not define any timeouts, which can cause the application to hang indefinitely in certain network failure scenarios.

Current Workaround
To mitigate this in our own application, we use a JwkSetUriJwtDecoderBuilderCustomizer to configure the RestTemplate with appropriate timeouts. While this works, the current default behavior is problematic and may impact other users as well.

@Configuration
public class JwtDecoderConfig {
 @Bean
 public JwkSetUriJwtDecoderBuilderCustomizer jwkSetUriJwtDecoderBuilderCustomizer() {
 return builder -> {
 SimpleClientHttpRequestFactory requestFactory = new SimpleClientHttpRequestFactory();
 requestFactory.setConnectTimeout(RemoteJWKSet.DEFAULT_HTTP_CONNECT_TIMEOUT);
 requestFactory.setReadTimeout(RemoteJWKSet.DEFAULT_HTTP_READ_TIMEOUT);
 builder.restOperations(new RestTemplate(requestFactory));
 };
 }
}

Proposal
We suggest that reasonable default timeouts (both connect and read) should be applied to the RestTemplate used by default in NimbusJwtDecoder. This change will help prevent similar problems for others.