NimbusReactiveJsonWebTokenValidator runs on Netty event group threads

[kevin-wise]

Expected Behavior

NimbusReactiveJsonWebTokenValidator should delegate to another thread pool so that RoleFinders etc won't run on a Netty event group thread

Actual Behaviour

NimbusReactiveJsonWebTokenValidator runs on a Netty event group thread.

JwtTokenProvider delegated to BLOCKING, but NimbusReactiveJsonWebTokenValidator does not. I would expect the behavior not to change. My RolesFinder implementation hits a database, so it has blocking operations. At the very least, I should have a way to configure it to use an executor service.

Steps To Reproduce

Create an application with io.micronaut.security:micronaut-security-jwt and io.micronaut:micronaut-http-server. Set a breakpoint in the RolesFinder resolveRoles function and you will see that it gets called on a Netty thread.

Environment Information

JDK 21

Example Application

No response

Version

4.6.6 (core) / 4.6.3 (platform) / micronaut-security-jwt 4.10.2