Error occurred while attempting to decode the Jwt

Question

Error occurred while attempting to decode the Jwt

Abhishek A 0

We observed two brief spikes of 401 Unauthorized errors in our 2 different services. These were caused by transient network failures preventing our services from communicating with Microsoft’s Identity Provider to verify JWT signatures. These were infrastructure-level blips and not application bugs.

Error Details:

Timeout while waiting for cache refresh (15000ms exceeded). (The service waited 15s for the network to respond before failing). NO PROXY ERRORS: org.springframework.security.authentication.AuthenticationServiceException: An error occurred while attempting to decode the Jwt: Timeout while waiting for cache refresh (15000ms exceeded)
Connection refused (I/O error on GET request to login.windows.net): org.springframework.security.authentication.AuthenticationServiceException: An error occurred while attempting to decode the Jwt: I/O error on GET request for "https://login.windows.net/common/discovery/keys": Connection refused

Jerald Felix 10,220 Reputation points

2026-01-01T06:27:29.15+00:00
Hello Abhishek A,

Thanks for posting this question in Q&A. 401 Unauthorized spikes (15s timeouts) on login.windows.net are transient network blips preventing your Spring services from fetching Microsoft JWK signing keys. The default Nimbus cache refresh (5 min) is failing during these outages.

Why it happens

Cache Refresh Timeout: Your service tries to verify a JWT with a new key (KID) not in its cache. It attempts a live fetch from Microsoft, which times out after 15 seconds.

Connection Refused: Total network failure between your infrastructure and login.windows.net/common/discovery/keys.

Immediate Fixes

1. Increase Cache Life & Tolerance Configure your JwtDecoder to pre-fetch and retain keys longer to survive transient blips.

java @Bean

2. Enable JWK Resiliency Move to the V2 endpoint (Microsoft Entra ID) which is more resilient and globally distributed.

text spring: security: oauth2: resourceserver: jwt: # Use login.microsoftonline.com instead of login.windows.net issuer-uri: https://login.microsoftonline.com/{tenant-id}/v2.0

Resilience Checklist

Retries: Add a RetryTemplate to your JWK set retrieval.

Monitoring: Alert on AuthenticationServiceException + "Discovery keys timeout".

Local Cache: For high-scale, consider a custom JWKSource that caches keys for 24hrs.

Switching to the V2 endpoint + longer timeouts resolves most infrastructure-level blips. If helpful, accept the answer.

Cheers,

Jerald Felix

Your answer

Jerald Felix 10,220 Reputation points

2026-01-01T06:27:29.15+00:00

Hello Abhishek A,

Thanks for posting this question in Q&A. 401 Unauthorized spikes (15s timeouts) on login.windows.net are transient network blips preventing your Spring services from fetching Microsoft JWK signing keys. The default Nimbus cache refresh (5 min) is failing during these outages.

Why it happens

Cache Refresh Timeout: Your service tries to verify a JWT with a new key (KID) not in its cache. It attempts a live fetch from Microsoft, which times out after 15 seconds.

Connection Refused: Total network failure between your infrastructure and login.windows.net/common/discovery/keys.

Immediate Fixes

1. Increase Cache Life & Tolerance Configure your JwtDecoder to pre-fetch and retain keys longer to survive transient blips.

java @Bean

2. Enable JWK Resiliency Move to the V2 endpoint (Microsoft Entra ID) which is more resilient and globally distributed.

text spring: security: oauth2: resourceserver: jwt: # Use login.microsoftonline.com instead of login.windows.net issuer-uri: https://login.microsoftonline.com/{tenant-id}/v2.0

Resilience Checklist

Retries: Add a RetryTemplate to your JWK set retrieval.

Monitoring: Alert on AuthenticationServiceException + "Discovery keys timeout".

Local Cache: For high-scale, consider a custom JWKSource that caches keys for 24hrs.

Switching to the V2 endpoint + longer timeouts resolves most infrastructure-level blips. If helpful, accept the answer.

Cheers,

Jerald Felix

Share via

Error occurred while attempting to decode the Jwt

Why it happens

Resilience Checklist

Your answer