Connection and Read Timeouts for Embedded Servers
Fast recall
Quick revision
Core answer
server.tomcat.connection-timeout=20000 (how long Tomcat waits for a client to send the HTTP request after TCP connection established — defaults to 20 seconds on modern Boot; was 60s historically). Not to be confused with idle keep-alive timeout (server.tomcat.keep-alive-timeout). Outbound: configure timeouts on the HTTP client itself. For RestTemplate, set connect and read timeouts on HttpComponentsClientHttpRequestFactory. For WebClient, set them on the Netty HttpClient. The most common production bug is missing outbound read timeouts — a call to a slow downstream service blocks a thread indefinitely, exhausts the pool, and cascades the failure to the entire application. Always pair timeouts with a circuit breaker (Resilience4j) so repeated failures don't keep consuming threads.Whether you distinguish inbound server timeouts from outbound client timeouts, and whether you know missing outbound timeouts is a classic cascading-failure cause
Conflating server-side `server.tomcat.connection-timeout` with client-side read timeout; not setting timeouts on `RestTemplate` or `WebClient`; forgetting circuit breakers as companions to timeouts
Describe the cascading-failure chain (slow downstream → threads blocked → pool exhausted → whole app unavailable), and mention Resilience4j and bulkheads as defense in depth
Interview-ready guide
Interview answer
Inbound vs outbound — two different problems
Inbound (embedded Tomcat)
server.tomcat.connection-timeout=20000— how long Tomcat waits for the client to send a request after TCP accept- Protects against slow clients holding connections open without sending data
Outbound (HTTP clients you call)
RestTemplate— timeouts onHttpComponentsClientHttpRequestFactoryWebClient— on the NettyHttpClient- Feign —
spring.cloud.openfeign.client.config.*
The single most common production bug
RestTemplatedefaults to no timeout on any setting- A forgotten
RestTemplatecalling a slow downstream blocks its thread forever - One dependent service takes down the caller
The cascading failure pattern
- Slow downstream → outbound calls hang → workers blocked → thread pool fills → health checks fail → service ejected → traffic shifts → next instance → cascades
- Read timeout alone caps per-request damage but doesn't prevent throughput collapse
Defense in depth = timeout + circuit breaker + bulkhead
- Timeout — protects per-request
- Resilience4j circuit breaker — opens after too many failures, fails fast instead of blocking
- Bulkhead — caps concurrent calls per downstream so one slow service can't starve the others
Sensible defaults for a new service
- Connect timeout: 3 s
- Read timeout: 10–30 s (match downstream SLA)
- Connection-request timeout: 2 s
- Always paired with a circuit breaker in prod
Connection and Read Timeouts for Embedded Servers
Direct Answer
Spring Boot distinguishes inbound (server receiving requests) from outbound (client making requests). Inbound: server.tomcat.connection-timeout=20000 (how long Tomcat waits for a client to send the HTTP request after TCP connection established — defaults to 20 seconds on modern Boot; was 60s historically). Not to be confused with idle keep-alive timeout (server.tomcat.keep-alive-timeout). Outbound: configure timeouts on the HTTP client itself. For RestTemplate, set connect and read timeouts on HttpComponentsClientHttpRequestFactory. For WebClient, set them on the Netty HttpClient. The most common production bug is missing outbound read timeouts — a call to a slow downstream service blocks a thread indefinitely, exhausts the pool, and cascades the failure to the entire application. Always pair timeouts with a circuit breaker (Resilience4j) so repeated failures don't keep consuming threads.
Common Mistakes & Pitfalls
Conflating server-side server.tomcat.connection-timeout with client-side read timeout; not setting timeouts on RestTemplate or WebClient; forgetting circuit breakers as companions to timeouts
Check your understanding
Answer these without looking back at the article.
- What's the difference between `responseTimeout` in Netty and Apache's `setResponseTimeout`?
- How does Resilience4j's circuit breaker differ from Hystrix's thread-pool-based model?
- Why is `@Transactional(timeout=30)` not equivalent to setting JDBC socket timeout?
- How would you implement per-endpoint read timeouts on a single RestTemplate?
Related interview prep categories
1Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.