[edsonsims]

OIDC discovery and token requests currently have no timeout. A provider can also return headers and then stall a JSON or error body, leaving authentication waiting indefinitely. This change applies a five-second deadline to each external auth GET/POST, including response-body consumption, and reports an abort through the existing WeaviateRequestTimeoutError.

Addresses the authentication-timeout portion of #7. Early token refresh and retry behavior from that issue remain separate work.

The private fetch helper accepts an optional response consumer so the auth deadline stays active through checkStatus(true). Other REST calls and getRaw retain their existing header-deadline behavior. Timers are cleared on success or failure, and ordinary HTTP error classes are preserved. This is a per-request deadline, not a bound on the entire multi-step login.

Validation

• Against the original implementation, the response-body regression suite produced 3 failures / 3 passes; the native stalled-body case reached its eight-second outer guard.
• With this patch, 27 focused tests pass across the auth timeout, response-body and existing connection mock suites on Node 24.19.0. A real loopback HTTP server verifies that stalled GET and POST bodies are aborted and their sockets close at the five-second deadline.
• Full build (core, Node CJS/ESM and web/browser-safe check), lint and formatting checks pass.
• A live Weaviate cluster and external identity-provider matrix were not run.

The existing timeout message's unit wording is unchanged; #480 addresses that separately.

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[weaviate-git-bot]

To avoid any confusion in the future about your contribution to Weaviate, we work with a Contributor License Agreement. If you agree, you can simply add a comment to this PR that you agree with the CLA so that we can merge.

beep boop - the Weaviate bot 👋🤖

PS:
Are you already a member of the Weaviate Forum?

[edsonsims]

I agree to the Weaviate Contributor License Agreement.