carrier thread be suspended by synchronized in RemoteJWKSet

[me0106]

RemoteJWKSet use synchronized for synchronization.
But this will suspend the carrier thread.
In some specific situations, it may cause the server to hang:

single carrier thread.(Single core CPU). And call itself to retrieve jwk.

RemoteJWKSet is deprecated. Should we replace it with JwkSourceBuilder?

SpringBoot: 3.3.1
Java: Temurin-21.0.4+7

[rwinch]

Thank you for the report. Would you be interested in submitting a pull request to replace RemoteJWKSet?

[franticticktick]

Hi @rwinch, in this issue we need to replace the old jose api with a new one. This is not a very simple issue, for example JWKSetCache is now deprecated, and it is needed for JwkSourceBuilder. I can think about how to solve this issue.

[rwinch]

Closing as duplicate of gh-16251

[frido37]

Removing the deprecated usages of RemoteJWKSet (issue #16251) did not resolve the underlying issue: there is still a remote HTTP call performed within a critical section. While the synchronization mechanism has changed from synchronized to a ReentrantLock, the fundamental concern remains.

To address this, I’ve proposed a fix in pull request #17669.