Proxy JWKS Downloads for Spring’s Reactive JWT Decoder

Inject the client into NimbusReactiveJwtDecoder and keep the existing issuer, audience and other token checks when wiring it into the resource server.

var transport = reactor.netty.http.client.HttpClient.create()
    .proxy(spec -> spec
        .type(reactor.netty.transport.ProxyProvider.Proxy.HTTP)
        .host("proxy.example")
        .port(8080));
var webClient = org.springframework.web.reactive.function.client.WebClient
    .builder()
    .clientConnector(new org.springframework.http.client.reactive
        .ReactorClientHttpConnector(transport))
    .build();

var decoder = org.springframework.security.oauth2.jwt.NimbusReactiveJwtDecoder
    .withJwkSetUri(jwkSetUri)
    .webClient(webClient)
    .build();
decoder.setJwtValidator(org.springframework.security.oauth2.jwt.JwtValidators
    .createDefaultWithIssuer(issuer));

Use the trusted jwkSetUri/issuer values and install this decoder via the actual ReactiveJwtDecoder bean or explicit resource-server configuration. Creating it beside an unchanged active decoder does not change key retrieval. If the trusted JWKS URL is public and public intermediaries are permitted, the HTTP proxy list supplies candidates for the no-account transport host and port.

The shown validator keeps default time checks and issuer validation. Retain audience requirements and all additional application validators when replacing the decoder.

A known key URI bypasses discovery for locating it. If another component still performs discovery or token acquisition, configure that client's route separately.

This covers reactive resource-server JWT verification. Servlet resource server, OAuth2 login and business API clients have other hooks; keep the failed key URL and stage with the investigation.

Ũhoro ũhĩtĩte