Skip to content

SslBundle integration with FeignClients #974

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ffroliva opened this issue Jan 31, 2024 · 6 comments
Open

SslBundle integration with FeignClients #974

ffroliva opened this issue Jan 31, 2024 · 6 comments
Labels
enhancement New feature or request help wanted Extra attention is needed

Comments

@ffroliva
Copy link

ffroliva commented Jan 31, 2024

Recently, in spring-boot 3.1, spring team introduced the SslBundles component as a convenient way to configure SSL connection to RestTemplate and RestClient.

As reference: https://spring.io/blog/2023/06/07/securing-spring-boot-applications-with-ssl

I similar approach would be interesting to exist in the spring-cloud-openfeign.

I am currently taking the following approach:

application.yml

spring:
 ssl:
   bundle:
     jks:
       secure-service:
         key:
           alias: "secure-service"
         keystore:
           location: "classpath:keystore.p12"
           password: "myStrongPassword"
           type: "PKCS12"
    @Bean
    @ConditionalOnProperty(prefix = "spring.ssl.bundle.jks.secure-service.key", name = "alias")
    public Client feignClient(SslBundles sslBundles) throws Exception {
        // "secure-service" is defined in application properties
        try {
            SslBundle sslBundle = sslBundles.getBundle("secure-service");
            SSLContext sslContext = sslBundle.createSslContext();
            log.info("Configuring SSL Context for FeignClient");
            return new Client.Default(sslContext.getSocketFactory(), new DefaultHostnameVerifier());
        } catch (NoSuchSslBundleException ex) {
            log.error("SSLContext not provided. Creating FeignClient without sslContext.");
            throw new IllegalStateException("spring.ssl.bundle.jks.secure-service.key.alias not configure correctly. Please change your application properties, yml or environment configuration.");
        }
    }

I proposed approach would be similar to this:

    @Bean
    public restTemplate(RestTemplateBuilder restTemplateBuilder, SslBundles sslBundles) {
        this.restTemplate = restTemplateBuilder.setSslBundle(sslBundles.getBundle("secure-service")).build();
    }

Further reference: https://www.baeldung.com/spring-boot-security-ssl-bundles

@OlgaMaciaszek
Copy link
Collaborator

Hello @ffroliva, thanks for reporting the issue. Spring Cloud OpenFeign is now in maintenance only mode (we suggest migrating to Spring Interface Clients. We're not adding new features, only working on bugfixes and reviewing small community PRs, so we'll not be including this in the backlog.

@OlgaMaciaszek
Copy link
Collaborator

@ffroliva as written above, we won't be working on this, but seeing this is not a big change, let me know if you'd like to create a PR.

@OlgaMaciaszek OlgaMaciaszek reopened this Jan 31, 2024
@OlgaMaciaszek OlgaMaciaszek added help wanted Extra attention is needed enhancement New feature or request and removed closeable labels Jan 31, 2024
@samuelstein
Copy link

samuelstein commented Mar 14, 2025

Good to know that openfeign is in maintenance mode. I didn't know before.
Would be nice if you could document this at least in the readme @OlgaMaciaszek.

@OlgaMaciaszek
Copy link
Collaborator

@samuelstein it's been in the docs for quite a long time: https://docs.spring.io/spring-cloud-openfeign/reference/, but you're right. I'll add this to the README as well.

@samuelstein
Copy link

I know but it is hidden on the first page. A hint on the project page (https://spring.io/projects/spring-cloud-openfeign#overview) would also be useful.

@OlgaMaciaszek
Copy link
Collaborator

I agree. I'll add this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request help wanted Extra attention is needed
Projects
None yet
Development

No branches or pull requests

4 participants