adal sender won't timeout

go.mod

module github.com/haitch/adalsender-defect

go 1.18

require github.com/Azure/go-autorest/autorest/adal v0.9.22

require (
	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
	github.com/Azure/go-autorest/logger v0.2.1 // indirect
	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
	github.com/golang-jwt/jwt/v4 v4.0.0 // indirect
	golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa // indirect
)

main.go

package main

import (
	"fmt"
	"net/http"
	"net/http/httptest"
	"time"

	"github.com/Azure/go-autorest/autorest/adal"
)

func main() {
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		if r.URL.Path == "/testTenant/oauth2/token" {
			fmt.Println("got request, holding it fore 65s")
			time.Sleep(65 * time.Second) // adal sender won't timeout
			fmt.Fprintln(w, `{"access_token": "abc", "refresh_token":""}`)
			w.WriteHeader(http.StatusOK)
			return
		}
		w.WriteHeader(http.StatusNotFound)
	}))

	// tried in play.golang.org, ts.URL is not reachable.
	activeDirectoryEndpoint := ts.URL
	tenantID := "testTenant"
	oauthConfig, _ := adal.NewOAuthConfig(activeDirectoryEndpoint, tenantID)

	spt, err := adal.NewServicePrincipalToken(
		*oauthConfig,
		"testApp",
		"not a secret",
		"https://management.core.windows.net/",
		nil...)
	if err != nil {
		panic(err)
	}

	start := time.Now()
	fmt.Println(start)
	err = spt.Refresh()
	if err == nil {
		fmt.Println("got token")
	} else {
		panic(err)
	}

	duration := time.Since(start)
	fmt.Println(duration)
	ts.Close()
}

was expecting it to timeout after 30s, 60s, but neither happens, it could block the code for more than 15min.