search

spring-projects / spring-security

Spring Security
http://spring.io/projects/spring-security
Apache License 2.0
8.84k stars 5.91k forks source link

carrier thread be suspended by synchronized in RemoteJWKSet #15866

Open me0106 opened 1 month ago

me0106 commented 1 month ago

RemoteJWKSet use synchronized for synchronization. But this will suspend the carrier thread. In some specific situations, it may cause the server to hang:

single carrier thread.(Single core CPU). And call itself to retrieve jwk.

RemoteJWKSet is deprecated. Should we replace it with JwkSourceBuilder?

SpringBoot: 3.3.1 Java: Temurin-21.0.4+7

image image

rwinch commented 1 month ago

Thank you for the report. Would you be interested in submitting a pull request to replace RemoteJWKSet?

franticticktick commented 1 month ago

Hi @rwinch, in this issue we need to replace the old jose api with a new one. This is not a very simple issue, for example JWKSetCache is now deprecated, and it is needed for JwkSourceBuilder. I can think about how to solve this issue.