# Proxy/Netty: io.netty.channel.ConnectTimeoutException: connection timed out

**URL:** <https://devforum.okta.com/t/proxy-netty-io-netty-channel-connecttimeoutexception-connection-timed-out/10133>\
**Category:** Questions\
**Created:** [July 14, 2020, 9:53pm UTC](https://devforum.okta.com/t/proxy-netty-io-netty-channel-connecttimeoutexception-connection-timed-out/10133 "2020-07-14T21:53:43Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![bdemers](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/bdemers/32/23_2.png) [@bdemers](https://devforum.okta.com/u/bdemers)\
**Post date:** [August 26, 2020, 7:28pm UTC](https://devforum.okta.com/t/proxy-netty-io-netty-channel-connecttimeoutexception-connection-timed-out/10133/4 "2020-08-26T19:28:08Z")

</div>

Sorry for the delay on this one.

It looks like this is a known issue for Spring Security:

- [https://github.com/reactor/reactor-netty/issues/887](https://github.com/reactor/reactor-netty/issues/887)
- [https://stackoverflow.com/questions/58689235/proxy-setting-not-working-with-spring-webclient](https://stackoverflow.com/questions/58689235/proxy-setting-not-working-with-spring-webclient)
- [https://github.com/spring-projects/spring-security/issues/8882](https://github.com/spring-projects/spring-security/issues/8882)

I have a couple of suggestions:

1. Remove the need for a proxy, you could whitelist the domains you need (or specific URLs if needed)  
I know this isn’t always possible, especially when someone else manages the network, but it’s _easiest_ option, so I figured I’d suggest it

2. Override the WebClient where it’s used.

You could `BeanPostProcessor` it, and tweak the `WebClient` `org.springframework.security.oauth2.client.userinfo.DefaultReactiveOAuth2UserService.setWebClient(...)`

same for `org.springframework.security.oauth2.client.oidc.userinfo.OidcReactiveOAuth2UserService`

If you are also validating JWTs you would need to replace the `ReactiveJwtDecoder` bean from:

> <https://github.com/okta/okta-spring-boot/blob/0fab5771d56b4f653ee4ae980a1dfa63cd58bbf3/oauth2/src/main/java/com/okta/spring/boot/oauth/ReactiveOktaOAuth2ResourceServerAutoConfig.java#L43>

With something like:

```java
NimbusReactiveJwtDecoder.withJwkSetUri(oAuth2ResourceServerProperties.getJwt().getJwkSetUri())
            .webClient(...)

```

Where your custom webClient is something like:

```java
HttpClient httpClient = HttpClient.create()
            .tcpConfiguration(tcpClient -> tcpClient
                .proxy(proxy -> proxy
                    .type(ProxyProvider.Proxy.HTTP)
                    .host("ourproxy.com")
                    .port(8080)));

```

---

_[View the full topic](https://devforum.okta.com/t/proxy-netty-io-netty-channel-connecttimeoutexception-connection-timed-out/10133)._