Issue with Jetty virtual threads enabled and Cache

[diegoatpitch]

Checklist

• I have looked into the Readme and Examples, and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

Hello. We are trying to enable Jetty support for Virtual Threads and we hit an issue with GuavaCachedJwkProvider. It uses com.google.common.cache.LocalCache which is synchronized, causing thread pinning.

Reproduction

I found this by enabling this JVM option -Djdk.tracePinnedThreads=full, which produced the following stack trace (clamped to remove internal namespaces)

    com.auth0.jwk.UrlJwkProvider.getJwks(UrlJwkProvider.java:136)
    com.auth0.jwk.UrlJwkProvider.getAll(UrlJwkProvider.java:145)
    com.auth0.jwk.UrlJwkProvider.get(UrlJwkProvider.java:163)
    com.auth0.jwk.RateLimitedJwkProvider.get(RateLimitedJwkProvider.java:28)
    com.auth0.jwk.GuavaCachedJwkProvider.lambda$get$0(GuavaCachedJwkProvider.java:62)
    com.google.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4860)
    com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3551)
    com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2302)
    com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2177) <== monitors:1
    com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2068)
    com.google.common.cache.LocalCache.get(LocalCache.java:3986)
    com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4855)
    com.auth0.jwk.GuavaCachedJwkProvider.get(GuavaCachedJwkProvider.java:62)

Additional context

There is this issue in Guava repository, but it's closed as "won't fix" as they suggest using Caffeine for caching instead.

For reference, Spring has replaced Guava Caching with Caffeine: spring-projects/spring-framework#18370

jwks-rsa version

0.22.1

Java version

21

[ben-manes]

Caffeine also uses synchronized, as does the underlying ConcurrentHashMap. It’s not too bad if using AsyncCache since the loading is done by a future which doesn’t use a synchronized mutex, but generally the suggestion is to use jdk24+ if you want to avoid pinning.

[diegoatpitch]

Thanks Ben! I did not know about jdk24 capability of running virtual threads without causing thread pinning.

Maybe the issue could be repurposed to trigger the discussion of replacing LocalCache anyway, if that's helpful. Otherwise I'll close the issue a bit later.

[tanya732]

Hi @diegoatpitch,

Thanks for reporting!! You're right that GuavaCachedJwkProvider uses synchronized code in LocalCache, which can cause thread pinning with virtual threads. I’m not entirely sure yet about the full implications of this, but I’ll dig deeper to better understand the impact and possible solutions.

We’ll explore Caffeine for those using virtual threads. We will keep you updated.

Thank you