AutoConfiguredRestClientSsl overwrites configuration from HttpClientProperties

[kzander91]

This is similar to #36594 and #27360 but I'm not sure if a solution for those issues would also fix mine, so feel free to close this if you consider this to be a duplicate.

Issue: Configuration made through the spring.http.client properties is ignored if I use AutoConfiguredRestClientSsl. For example, configuration like

spring:
  http:
    client:
      redirects: dont_follow

does not work if I also have this:

@Bean
RestClientCustomizer clientCertConfigurer(RestClientSsl restClientSsl) {
    return builder -> builder.apply(restClientSsl.fromBundle("my-bundle"));
}

The reason for this is that AutoConfiguredRestClientSsl replaces the request factory and thus discards any configuration made via the spring.http.client properties:

spring-boot/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/client/AutoConfiguredRestClientSsl.java

Lines 52 to 56 in 1832852

	return (builder) -> {
	ClientHttpRequestFactorySettings settings = ClientHttpRequestFactorySettings.ofSslBundle(bundle);
	ClientHttpRequestFactory requestFactory = this.clientHttpRequestFactoryBuilder.build(settings);
	builder.requestFactory(requestFactory);
	};

For this specific issue I can work around this by removing my RestClientCustomizer and use

spring:
  http:
    client:
      redirects: dont_follow
      ssl:
        bundle: "my-bundle"

instead, but this only works in this static scenario, if I needed some more sophisticated logic to determine the SSL bundle to use at runtime, this wouldn't work.

[wilkinsona]

I think this is working as documented:

spring-boot/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/client/RestClientSsl.java

Lines 38 to 42 in 15b63fa

	* </pre> NOTE: Apply SSL configuration will replace any previously
	* {@link RestClient.Builder#requestFactory configured} {@link ClientHttpRequestFactory}.
	* If you need to configure {@link ClientHttpRequestFactory} with more than just SSL
	* consider using a {@link ClientHttpRequestFactorySettings} with
	* {@link ClientHttpRequestFactories}.

[kzander91]

This note and also the corresponding sentences in the reference docs don't really tell me that this affects the spring.http.client properties. Without studying the corresponding auto configuration code, how am I supposed to know that these properties work on their own instance of a ClientHttpRequestFactory that may then later be replaced if other configuration beans are defined?
Other features provided by Boot are additive, where I can use a mix of properties and customizer beans, but here for HTTP clients, I can't.

I'm aware that the Boot team is aware of these configuration limitations, and I'm seeing my issue here as another one of those. If you disagree, then I'd say that this is a documentation issue. Maybe you could consider adding warning boxes to the documentation sections where the HTTP properties and SSL configuration are described, warning users that the properties are ignored if certain other beans are defined.

[philwebb]

Closing in favor of PR #44979, thanks @nosan!