Fix race condition in JwtDecoder caching with computeIfAbsent

[Copilot]

The getJwtDecoder method had a race condition where concurrent threads could create duplicate JwtDecoder instances for the same jwkSetUri due to non-atomic check-then-act operations.

Changes

• Replaced manual get()/put() pattern with computeIfAbsent() for atomic decoder creation
• Ensures single JwtDecoder instance per jwkSetUri under concurrent access

Before:

JwtDecoder jwtDecoder = this.jwtDecoders.get(jwkSetUri);
if (jwtDecoder == null) {
    jwtDecoder = decoderBuilder.build();
    this.jwtDecoders.put(jwkSetUri, jwtDecoder);
}
return jwtDecoder;

After:

return this.jwtDecoders.computeIfAbsent(jwkSetUri, uri -> {
    NimbusJwtDecoder.JwkSetUriJwtDecoderBuilder decoderBuilder = 
        NimbusJwtDecoder.withJwkSetUri(uri).jwsAlgorithm(SignatureAlgorithm.from(JwsAlgorithms.RS256));
    if (restOperations != null) {
        decoderBuilder.restOperations(restOperations);
    }
    return decoderBuilder.build();
});

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• build.shibboleth.net
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.11/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.11/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.11 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.11/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/spring-security-lti13/spring-security-lti13 org.codehaus.plexus.classworlds.launcher.Launcher clean compile (dns block)
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.11/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.11/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.11 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.11/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/spring-security-lti13/spring-security-lti13 org.codehaus.plexus.classworlds.launcher.Launcher test (dns block)
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -classpath /tmp/semmleTempDir17595382822150956778/apache-maven-3.8.8/boot/plexus-classworlds-2.6.0.jar -Dclassworlds.conf=/tmp/semmleTempDir17595382822150956778/apache-maven-3.8.8/bin/m2.conf -Dmaven.home=/tmp/semmleTempDir17595382822150956778/apache-maven-3.8.8 -Dlibrary.jansi.path=/tmp/semmleTempDir17595382822150956778/apache-maven-3.8.8/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/spring-security-lti13/spring-security-lti13 org.codehaus.plexus.classworlds.launcher.Launcher -f pom.xml -B -V -e -Dfindbugs.skip -Dcheckstyle.skip -Dpmd.skip=true -Dspotbugs.skip -Denforcer.skip -Dmaven.javadoc.skip -DskipTests (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR fixes a race condition in JWT decoder caching by replacing a non-atomic check-then-act pattern with the atomic computeIfAbsent() operation, ensuring thread-safe creation of JwtDecoder instances.

Key Changes:

• Replaced manual get()/put() operations with ConcurrentHashMap.computeIfAbsent() for atomic decoder creation
• Corrected spelling in comment from "it's" to "its"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.