RemoteJWKSetOptions timeout not working

[bondyr]

What happened?

What happens:
When jwtVerify is called with a function created by createRemoteJWKSet as an argument, and server is irresponsive, there's no timeout. Request keeps hanging until server shuts down the connection.

What is expected:
Request times out after RemoteJWKSetOptions.timeoutDuration period and exception is thrown.

Other:
The issue happens for both default and specified manually value of RemoteJWKSetOptions.timeoutDuration

Why:
It seems that timeout event is emitted by ClientRequest, but there's no listener function added so it's ignored in fetch_jwks.js

Where:

jose/dist/node/cjs/runtime/fetch_jwks.js
jose/dist/node/esm/runtime/fetch_jwks.js

Browser version seems to be working fine (I haven't tested it though, just telling by code analysis)
jose/dist/browser/runtime/fetch_jwks.js

Fix proposal:
In jose/dist/node/cjs/runtime/fetch_jwks.js and jose/dist/node/esm/runtime/fetch_jwks.js files:

    req.on('timeout', () => {
        req.abort();
    });

Version

3.14.3, 3.19.0

Runtime

Node.js

Runtime Details

node v14.15.4, Win10 + WSL2

Code to reproduce

// client side
const { createRemoteJWKSet } = require('jose/jwks/remote')
const { jwtVerify } = require('jose/jwt/verify')
const jwksUrl = 'http://localhost:3000'
const bearerToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'

const jwks = createRemoteJWKSet(new URL(jwksUrl), {
    timeoutDuration: 1000
})

jwtVerify(bearerToken, jwks, {})
  .then(() => console.log('Done.'))
  .catch(err => console.log('Error: ', err))





// server side
const express = require('express')
const app = express()
const port = 3000

app.get('/', (req, res) => {
  // don't send any response
})

app.listen(port, () => {
  console.log(`Example app listening at http://localhost:${port}`)
})

• I have searched the issues tracker and discussions for similar topics and couldn't find anything related.
• I agree to follow this project's Code of Conduct

[panva]

@bondyr thank you for the issue description, this is a helpful find!

[bondyr]

@panva Do you have any rough estimate when it might get fixed?

[panva]

@bondyr When I have the time to look into it myself or someone swoops in and magically offers their time and energy.

j/k of course free open source gets fixed ASAP.

[bondyr]

It was damn fast magic, thanks a lot!