title: How to increase RemoteJWKSet cache TTL in spring-security 5.2
body: <p>We are using spring-security 5.2 for securing our REST API through JWT validation.</p>
  
  <p>With the <code>spring:security:oauth2:resourceserver:jwt:jwk-set-uri</code> property we indicate the remote JWKS endpoint which
  translates into Spring creating a NimbusJwtDecoder based on this URI.
  Further down, a RemoteJWKSet object is created that caches the calls to the JWKS endpoint with a default TTL to 5 minutes.</p>
  
  <p>Is there a way to increase this TTL to minimise the remote calls ?
  Maybe injecting a new <code>DefaultJWKSetCache</code> instance somewhere with a different TTL ?
  It seems safe to keep this in cache for as long as possible because when we receive a token with an unknown kid, the call to the JWKS endpoint will be resumed to update the key set. </p>
  
  <p>The call stack for retrieving the key is bellow</p>
  
  <pre><code>JwtAuthenticationProvider
    public Authentication authenticate(Authentication authentication)
      ...
        jwt = this.jwtDecoder.decode(bearer.getToken())
      ...
  
  o.s.security.oauth2.jwt.NimbusJwtDecoder
      public Jwt decode(String token)
      ...
        Jwt createdJwt = createJwt(token, jwt);
      ...
  
      private Jwt createJwt(String token, JWT parsedJwt)
      ...
        JWTClaimsSet jwtClaimsSet = this.jwtProcessor.process(parsedJwt, null);
      ....
  
  DefaultJWTProcessor
        public JWTClaimsSet process(final JWT jwt, final C context)
          ...
            if (jwt instanceof SignedJWT) {
                  return process((SignedJWT)jwt, context);
                  }
          ...
  
        public JWTClaimsSet process(final SignedJWT signedJWT, final C context)
              ...
                List&lt;? extends Key&gt; keyCandidates = selectKeys(signedJWT.getHeader(), claimsSet, context);
            ...
  
        private List&lt;? extends Key&gt; selectKeys(final JWSHeader header, final JWTClaimsSet claimsSet, final C context)
          ....
            if (getJWSKeySelector() != null) {
                   return getJWSKeySelector().selectJWSKeys(header, context);
                   }      
          ....  
  
  
  JWSVerificationKeySelector
    public List&lt;Key&gt; selectJWSKeys(final JWSHeader jwsHeader, final C context)
      ...
        List&lt;JWK&gt; jwkMatches = getJWKSource().get(new JWKSelector(jwkMatcher), context);
      ...
  
  RemoteJWKSet
    public List&lt;JWK&gt; get(final JWKSelector jwkSelector, final C context)
    ...
      JWKSet jwkSet = jwkSetCache.get();
          if (jwkSet == null) {
              jwkSet = updateJWKSetFromURL();
          }
    ...
  
  
  DefaultJWKSetCache  
    public JWKSet get() {
  
      if (isExpired()) {
        jwkSet = null; // clear
      }
  
      return jwkSet;
    }
  </code></pre>
  
  <p>Security dependencies:</p>
  
  <pre><code>+- org.springframework.boot:spring-boot-starter-security:jar:2.2.4.RELEASE:compile
  |  +- org.springframework.security:spring-security-config:jar:5.2.1.RELEASE:compile
  |  \- org.springframework.security:spring-security-web:jar:5.2.1.RELEASE:compile
  +- org.springframework.security:spring-security-oauth2-jose:jar:5.2.2.RELEASE:compile
  |  +- org.springframework.security:spring-security-core:jar:5.2.1.RELEASE:compile
  |  \- org.springframework.security:spring-security-oauth2-core:jar:5.2.1.RELEASE:compile
  +- com.nimbusds:nimbus-jose-jwt:jar:8.8:compile
  |  +- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile
  |  \- net.minidev:json-smart:jar:2.3:compile (version selected from constraint [1.3.1,2.3])
  |     \- net.minidev:accessors-smart:jar:1.2:compile
  |        \- org.ow2.asm:asm:jar:5.0.4:compile
  +- org.springframework.security:spring-security-oauth2-resource-server:jar:5.2.1.RELEASE:compile
  </code></pre>