Avoid silent default to http://localhost:80 in ReactorHttpClientConnector [SPR-15782]

[spring-projects-issues]

Abhijit Sarkar opened SPR-15782 and commented

In the following code, baseUrl is not replaced and defaults to http://localhost:80.

WebClient.builder()
    .build()
    .get()
    .uri("{baseUrl}/api/v4/groups/{groupName}", baseUrl, groupName)

---

Affects: 5.0 RC2

Referenced from: commits 147368e

[spring-projects-issues]

Rossen Stoyanchev commented

This is expected behavior actually since at the time of parsing, the URI template looks like a path.

Depending on how much you need to customize (i.e. literal vs variable):

WebClient.builder()
		.build()
		.get()
		.uri("http://{host}:{port}/api/v4/groups/{groupName}", "localhost", "8080", "foo")

You could also set the baseUrl at the builder level:

WebClient.builder()
		.baseUrl("http://{host}:{port}")
		.build()
		.get()
		.uri("/api/v4/groups/{groupName}", "localhost", "8080", "foo");

[spring-projects-issues]

Abhijit Sarkar commented

@Rossen Stoyanchev, I'm aware of the behavior you described; I think calling the method uri and silently ignoring base URL is very confusing. If you insist on keeping this behavior by design, then I suggest the following:

1. Rename method uri to path.
2. Log a warning if user tries to replace using a URI variable that has protocol (http(s)).

[spring-projects-issues]

Rossen Stoyanchev commented

Abhijit Sarkar point taken about the confusion. I'm trying to see what we can do to improve.

First, renaming from uri to path doesn't make sense because the method expects a URI template string as documented in the method it maps to UriComponentsBuilder#fromUriString and here is also the underlying pattern used where you will see the address components are optional.

Logging a warning if a URI variable has a protocol won't either do because it is legitimate to insert a URI, email address or anything into a path segment (e.g. as an identifier for some resource) in which case the URI variable value is encoded so that URI reserved characters won't change the URI structure.

Taking a closer look at what actually happens. The request that the WebClient prepares based on your example does not have scheme/host/port. So it is the underlying client (Reactor Netty) that defaults to http://localhost:8080. That is a clear issue in my opinion and the behavior could also vary when other HTTP clients are supported. Given that WebClient.Builder already supports setting a default baseUrl there is no reason to fall back on such defaults from the HTTP client. So I propose to raise an exception if the resulting URI does not have an actual address.

[spring-projects-issues]

Rossen Stoyanchev commented

Setting to RC3 since we'll make an improvement either way.

[spring-projects-issues]

Abhijit Sarkar commented

I think throwing an exception makes sense. That should've been among the options I'd suggested.