spring-cloud / spring-cloud/spring-cloud-gateway

SslBundle support does not honor SslOptions in HttpClientSslConfigurer

Open
#3,860 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

waiting-for-triage
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

Describe the bug
#2981 introduced SslBundle support which BTW a really nice feature.
However SslOptions of the bundle is not honored by the implementation.

E.g. the gateway user would like to restrict the cipher suites of the outbound http client via SslBundle features. (or disable a protocol).

Sample
This specific implementation
https://github.com/spring-cloud/spring-cloud-gateway/blob/093f4056c287c3beba2cf7219f5a1ee1206953c5/spring-cloud-gateway-server-webflux/src/main/java/org/springframework/cloud/gateway/config/HttpClientSslConfigurer.java#L71-L73

misses the following:

SslOptions sslOptions = bundle.getOptions();
if (sslOptions != null && sslOptions.isSpecified()) {
  sslContextBuilder.ciphers(SslOptions.asSet(sslOptions.getCiphers()));
  sslContextBuilder.protocols(sslOptions.getEnabledProtocols());
}

I guess the GrpcSslConfigurer as well misses the same thing since it was also modified when #2981 solved by this commit https://github.com/spring-cloud/spring-cloud-gateway/commit/0600b4d268435ee4eb8629c5a8bc50b4f7227586

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with HttpClientSslConfigurer.java at the linked SslBundle handling, then compare GrpcSslConfigurer.java because the issue reports the same omission there. Verify how SslOptions exposes ciphers and enabled protocols; done means both configurers honor specified bundle options without changing behavior when options are absent.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.