alibaba/nacos · warning · IOException

JWKS fetch interrupted

Error message

JWKS fetch interrupted

What it means

Thrown when the thread was interrupted during the blocking JWKS HTTP fetch (httpClient.send). The interrupt flag is re-set before throwing. This is a thread-lifecycle condition, not a request-logic error.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwksProvider.java:121

        String jwksUri = metadataProvider.getMetadata().getJwksUri();
        if (StringUtils.isBlank(jwksUri)) {
            throw new IOException("JWKS URI is not configured or discovered");
        }
        LOGGER.info("Fetching JWKS from: {}", jwksUri);
        HttpRequest request = HttpRequest.newBuilder().uri(URI.create(jwksUri))
            .header("Accept", "application/json").GET().build();
        try {
            HttpResponse<String> response =
                httpClient.send(request, HttpResponse.BodyHandlers.ofString());
            if (response.statusCode() != OidcProtocolConstants.HTTP_STATUS_OK) {
                throw new IOException("Failed to fetch JWKS, status: " + response.statusCode());
            }
            JWKSet result = JWKSet.parse(response.body());
            LOGGER.info("Successfully fetched JWKS with {} keys", result.getKeys().size());
            return result;
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            throw new IOException("JWKS fetch interrupted", e);
        } catch (ParseException e) {
            throw new IOException("Failed to parse JWKS", e);
        }
    }
    
    /**
     * Clear the cached JWK set.
     */
    public void clearCache() {
        jwksCache.invalidateAll();
    }
}

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Treat as transient: the next validation retries the fetch once the cache is empty.
2. If recurring at runtime, check for code interrupting validation threads.
3. Ensure the JWKS endpoint responds promptly to avoid prolonged blocking.
4. On shutdown this is benign and can be ignored.

try {
    jwksProvider.getJwkSet();
} catch (IOException e) {
    if ("JWKS fetch interrupted".equals(e.getMessage())) {
        // transient thread interruption — retry once if the thread is no longer interrupted
        if (!Thread.currentThread().isInterrupted()) {
            jwksProvider.getJwkSet();
        }
    } else {
        throw e;
    }
}

When it happens

Trigger: The thread performing JWKS fetch is interrupted while httpClient.send blocks — during shutdown, forced pool termination, or an interrupt during a slow JWKS response.

Common situations: Server shutting down during token validation; thread pool interrupted; slow IdP JWKS endpoint combined with an aggressive interrupt.

Related errors

• OIDC discovery interrupted
• Failed to fetch JWKS, status:
• Failed to parse JWKS
• Failed to initialize JWT processor:
• Token exchange failed:

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/4f4850098e8a7f46. Report an issue: GitHub.