Enable setting of a custom HTTP client for HTTPRequest.send

[Paolo Selvini]

The current com.nimbusds.oauth2.sdk.http.HTTPRequest does not allow to implement retry strategies to apply when sending requests. It would be nice and useful to allow setting a custom HTTPClient instance initialized with such behavior.

[Vladimir Dzhuvinov]

The JWT received a contribution for a similar facility last year. Perhaps it could be ported here, via an HTTPClient interface:

https://connect2id.com/products/nimbus-jose-jwt/examples/enhanced-jwk-retrieval

Do you have an HTTP client that you typically work with?

[Paolo Selvini]

I normally use the Apache HttpClient 4.x

[Yavor Vasilev]

Adding an interface to enable integration of external HTTP clients.

[Yavor Vasilev]

Makes title general

[Yavor Vasilev]

Implemented here: cbbb0af5

Released in:

version 11.0 (2023-09-20)
    * Breaking change: HTTPRequest.getURL and getURI returns a modified URL if
      setQuery(String), appendQueryString(String),
      appendQueryParameters(Map<String, List<String>) or setFragment(String)
      is called.
    * Adds HTTPRequestSender interface for implementing custom HTTPRequest
      dispatching via a new HTTPRequest.send(HTTPRequestSender) method.
    * Adds ReadOnlyHTTPMessage, ReadOnlyHTTPRequest and ReadOnlyHTTPResponse
      interfaces for the new HTTPRequestSender.
    * Adds HTTPRequest.appendQueryString(String) and
      appendQueryParameters(Map<String, List<String>) methods.
    * Adds HTTPMessage.getBody() and setBody(String) methods.
    * Adds HTTPMessage.getBodyAsFormParameters(), getBodyAsJSONObject(),
      getBodyAsJSONArray() and getBodyAsJWT() helper methods.
    * Deprecates HTTPRequest.getQuery() and setQuery(String). Use
      HTTPRequest.getURL().getQuery() and appendQueryString(String) instead.
    * Deprecates HTTPResponse.getContent(), getContentAsJSONObject.(),
      getContentAsJSONArray(), getContentAsJWT() and setContent(String).
    * Adds URLUtils.setEncodedQuery(String) and setEncodedFragment(String)
      methods.
    * URLUtils.parseParameters(String) switches to LinkedHashMap.
    * The TokenIntrospectionRequest.parse must use only the form parameters
      found in the request body, URL query string parameters must be ignored
      (iss #432).
    * Switches LogoutRequest.toHTTPRequest() from HTTP GET to POST to prevent
      the optional id_token_hint parameter from getting exposed in access logs
      (iss #439).

[Yavor Vasilev]

Mini how-to with Apache HttpClient 4.5 posted here:

https://connect2id.com/products/nimbus-oauth-openid-connect-sdk/examples/utils/custom-http-client

Happy coding!

[Paolo Selvini]

Thanks a lot Yavor, much appreciated!

There are just a couple of typos in the how-to:

1. at the beginning, HTTPRequestSender myHttpClient =newApacheHttpClient(); should read HTTPRequestSender customClient =newApacheHttpClient();
2. near the end of the sample code, httpResponse.setStatusMessage(statusLine.getReasonPhrase( should read httpResponse.setStatusMessage(statusLine.getReasonPhrase());

Finally, checking for response.getEntity().getContentLength() > 0 may not always be a good idea, as that apparently relies on the Content-Length HTTP header, which could not be returned by the HTTP server, even if content is actually there.

[Vladimir Dzhuvinov]

Hi Paolo,

Thanks for getting back with this feedback.

What is the correct way to check whether an Entity Body is present with an ApacheHttpClient?

[Paolo Selvini]

Hello Vladimir,

I usually simply check if response.getEntity() is null or not. However, the entity could be non-null and yet empty. so the org.apache.http.util.EntityUtils.toString() method could come in handy. It takes a (non-null) entity and returns a string: if the resulting string is empty then the entity body is empty.

I don’t know if this is the best or most correct method, but it generally works…

[Paolo Selvini]

Hello again,

about the TrustChainResolver, I see that there’s already the possibility to pass a custom EntityStatementRetriever, but I guess it’s not the same approach as the new HTTPRequestSender interface realized for this issue. Do you have any hint about how to use a custom HTTP Client for that as well?

[Yavor Vasilev]

The HTTP client example was fixed, thanks for your input.

We’ll try to check out the trust chain resolver HTTP handling next week.

[Paolo Selvini]

Hello Yavor, you mean the example at https://connect2id.com/products/nimbus-oauth-openid-connect-sdk/examples/utils/custom-http-client ? It still appears unchanged on the public page. Maybe you still have to make your changes public?

[Yavor Vasilev]

The site wasn’t synced, but now it is

Thanks for the heads up!

[Paolo Selvini]

Good! But there would also be that other minor fix in the initial code fragment at the top of the same page where you first define “myHttpClient” and then use “customClient” right below it.

[Yavor Vasilev]

A new ticket was created to track the OpenID Federation ES retrieval with custom HTTP client. You can track the progress there:

https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/issues/444/update-trustchainretriever-to-support-the

The example was fixed. It can be seen in this test

→

https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/src/test/java/com/nimbusds/oauth2/sdk/http/HTTPClientTest.java