perf(auth): reuse a shared reqwest::Client with timeouts (#172)

* perf(auth): reuse a shared reqwest::Client

OAuth discovery, metadata, and JWKS/introspection/userinfo fetches each built a fresh Client (new pool + TLS config) per call. Share one process-wide client so requests reuse the connection pool, which matters under concurrent key-rotation verifications.

Assisted-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Sergey Vilgelm <sergey@vilgelm.com>

* Configure shared HTTP client and add tests

Set connect_timeout to 10s and timeout to 30s and set a crate
user-agent. Fall back to reqwest::Client::new() on build error and emit
a tracing::warn. Add tests to verify the client is clonable and can
build requests without performing network calls.

---------

Signed-off-by: Sergey Vilgelm <sergey@vilgelm.com>
Co-authored-by: Sergey Vilgelm <sergey@vilgelm.com>

Author: hashemix

crates/rust-mcp-extra/src/token_verifier/generic_token_verifier.rs

@@ -4,8 +4,8 @@ use async_trait::async_trait;
 use reqwest::{header::AUTHORIZATION, StatusCode};
 use rust_mcp_sdk::{
     auth::{
-        decode_token_header, default_jwks_algorithms, Algorithm, Audience, AuthInfo,
-        AuthenticationError, IntrospectionResponse, JsonWebKeySet, OauthTokenVerifier,
+        decode_token_header, default_jwks_algorithms, shared_http_client, Algorithm, Audience,
+        AuthInfo, AuthenticationError, IntrospectionResponse, JsonWebKeySet, OauthTokenVerifier,
     },
     mcp_http::error_message_from_response,
 };
@@ -224,7 +224,7 @@ impl GenericOauthTokenVerifier {
             }
         };
 
-        let client = reqwest::Client::new();
+        let client = shared_http_client();
 
         let response = client
             .get(user_info_endpoint.to_owned())
@@ -267,7 +267,7 @@ impl GenericOauthTokenVerifier {
         token: &str,
         introspection_endpoint: &Url,
     ) -> Result<AuthInfo, AuthenticationError> {
-        let client = reqwest::Client::new();
+        let client = shared_http_client();
 
         // Form data body
         let mut form = HashMap::new();
@@ -355,7 +355,9 @@ impl GenericOauthTokenVerifier {
     }
 
     async fn populate_jwks(&self, jwks_uri: &Url) -> Result<(), AuthenticationError> {
-        let response = reqwest::get(jwks_uri.to_owned())
+        let response = shared_http_client()
+            .get(jwks_uri.to_owned())
+            .send()
             .await
             .map_err(|err| AuthenticationError::Jwks(err.to_string()))?;
         let jwks: JsonWebKeySet = response

crates/rust-mcp-sdk/src/auth.rs

@@ -22,3 +22,64 @@ pub use spec::Audience;
 pub use spec::*;
 #[cfg(feature = "auth")]
 pub use token_verifier::*;
+
+#[cfg(feature = "auth")]
+use std::sync::LazyLock;
+#[cfg(feature = "auth")]
+use std::time::Duration;
+
+/// Process-wide shared `reqwest::Client` used for OAuth discovery, metadata, and
+/// JWKS fetches.
+///
+/// Constructing a new `Client` per call creates a fresh connection pool and TLS
+/// configuration on every request. Cloning this shared client (cheap; it is
+/// `Arc`-backed) reuses the same pool, which matters during key-rotation events
+/// where many verifications fetch JWKS concurrently.
+///
+/// Configured with a `connect_timeout` of 10 seconds and a total `timeout` of
+/// 30 seconds to prevent hanging on unresponsive OAuth endpoints.
+#[cfg(feature = "auth")]
+static SHARED_HTTP_CLIENT: LazyLock<reqwest::Client> = LazyLock::new(|| {
+    reqwest::Client::builder()
+        .connect_timeout(Duration::from_secs(10))
+        .timeout(Duration::from_secs(30))
+        .user_agent(concat!("rust-mcp-sdk/", env!("CARGO_PKG_VERSION")))
+        .build()
+        .unwrap_or_else(|err| {
+            tracing::warn!(
+                ?err,
+                "failed to build configured shared HTTP client, falling back to default"
+            );
+            reqwest::Client::new()
+        })
+});
+
+/// Returns a clone of the process-wide shared [`reqwest::Client`].
+///
+/// The returned client reuses the same connection pool and TLS sessions.
+/// Two consecutive calls return independent clones of the same underlying
+/// client.
+#[cfg(feature = "auth")]
+pub fn shared_http_client() -> reqwest::Client {
+    SHARED_HTTP_CLIENT.clone()
+}
+
+#[cfg(all(test, feature = "auth"))]
+mod shared_client_tests {
+    use super::*;
+
+    #[test]
+    fn shared_http_client_is_clonable() {
+        let c1 = shared_http_client();
+        let c2 = shared_http_client();
+        // Both clones point to the same inner connection pool
+        assert_eq!(std::mem::size_of_val(&c1), std::mem::size_of_val(&c2));
+    }
+
+    #[test]
+    fn shared_http_client_accepts_url() {
+        let client = shared_http_client();
+        // Verify the client can build a request (no network call)
+        let _req = client.get("https://example.com").build().unwrap();
+    }
+}

crates/rust-mcp-sdk/src/auth/auth_provider/remote_auth_provider.rs

@@ -13,7 +13,6 @@ use async_trait::async_trait;
 use bytes::Bytes;
 use http::{header::CONTENT_TYPE, StatusCode};
 use http_body_util::{BodyExt, Full};
-use reqwest::Client;
 use std::{collections::HashMap, sync::Arc};
 
 /// Represents a **Remote OAuth authentication provider** integrated with the MCP server.
@@ -68,7 +67,7 @@ impl RemoteAuthProvider {
         token_verifier: Box<dyn OauthTokenVerifier>,
         required_scopes: Option<Vec<String>>,
     ) -> Result<Self, reqwest::Error> {
-        let client = Client::new();
+        let client = crate::auth::shared_http_client();
 
         let auth_server_meta = client
             .get(authorization_server_metadata_url)

crates/rust-mcp-sdk/src/auth/metadata.rs

@@ -5,7 +5,6 @@ use crate::{
     error::McpSdkError,
     utils::join_url,
 };
-use reqwest::Client;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use thiserror::Error;
@@ -139,7 +138,7 @@ impl<'a> AuthMetadataBuilder<'a> {
     where
         S: Into<Cow<'a, str>>,
     {
-        let client = Client::new();
+        let client = crate::auth::shared_http_client();
         let json: Value = client
             .get(discovery_url)
             .send()

crates/rust-mcp-sdk/src/auth/spec/discovery.rs

@@ -3,7 +3,6 @@ use crate::{
     error::McpSdkError,
     mcp_http::url_base,
 };
-use reqwest::Client;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use url::Url;
@@ -151,7 +150,7 @@ impl AuthorizationServerMetadata {
     /// to RFC 8414 (OAuth 2.0 Authorization Server Metadata) or OpenID Connect Discovery 1.0.
     ///
     pub async fn from_discovery_url(discovery_url: &str) -> Result<Self, McpSdkError> {
-        let client = Client::new();
+        let client = crate::auth::shared_http_client();
         let metadata = client
             .get(discovery_url)
             .send()