Class NoRedirectHttpClientConfiguration

java.lang.Object
io.micronaut.http.client.HttpClientConfiguration
io.micronaut.security.utils.NoRedirectHttpClientConfiguration
@Internal public final class NoRedirectHttpClientConfiguration extends io.micronaut.http.client.HttpClientConfiguration
An HttpClientConfiguration which copies the settings of another configuration but never follows redirects.

The HTTP clients Micronaut Security uses to talk to an identity provider (token endpoint, OpenID provider metadata, JWK Set, UserInfo) must not follow redirects. Otherwise a malicious or compromised provider could make the application send those requests, together with the client credentials or the user token, to any address the application can reach (SSRF) and the application would treat whatever JSON it finds there as the response of the provider.

Since:
5.5.2
Author:
Sergio del Amo

  • Nested Class Summary

    Nested classes/interfaces inherited from class io.micronaut.http.client.HttpClientConfiguration

    io.micronaut.http.client.HttpClientConfiguration.ConnectionPoolConfiguration, io.micronaut.http.client.HttpClientConfiguration.DnsResolutionMode, io.micronaut.http.client.HttpClientConfiguration.Http2ClientConfiguration, io.micronaut.http.client.HttpClientConfiguration.WebSocketCompressionConfiguration

  • Field Summary

    Fields inherited from class io.micronaut.http.client.HttpClientConfiguration

    DEFAULT_ALLOW_BLOCK_EVENT_LOOP, DEFAULT_BUFFER_ERROR_BODY_FOR_STREAMING, DEFAULT_CONNECTION_POOL_IDLE_TIMEOUT_SECONDS, DEFAULT_DNS_RESOLUTION_MODE, DEFAULT_EXCEPTION_ON_ERROR_STATUS, DEFAULT_FOLLOW_REDIRECTS, DEFAULT_MAX_CHUNK_SIZE, DEFAULT_MAX_CONTENT_LENGTH, DEFAULT_MAX_HEADER_SIZE, DEFAULT_MAX_INITIAL_LINE_LENGTH, DEFAULT_MAX_REDIRECTS, DEFAULT_READ_IDLE_TIMEOUT_MINUTES, DEFAULT_READ_TIMEOUT_SECONDS, DEFAULT_SHUTDOWN_QUIET_PERIOD_MILLISECONDS, DEFAULT_SHUTDOWN_TIMEOUT_MILLISECONDS

  • Constructor Summary

    Constructors
    Constructor
    Description
    NoRedirectHttpClientConfiguration(@NonNull io.micronaut.http.client.HttpClientConfiguration delegate)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    io.micronaut.http.client.HttpClientConfiguration.ConnectionPoolConfiguration
    getConnectionPoolConfiguration()
     
    @Nullable io.micronaut.http.client.HttpClientConfiguration.Http2ClientConfiguration
    getHttp2Configuration()
     
    @Nullable io.micronaut.http.client.HttpClientConfiguration.WebSocketCompressionConfiguration
    getWebSocketCompressionConfiguration()
     
    boolean
    isFollowRedirects()
     
    void
    setFollowRedirects(boolean followRedirects)
    Ignored.

    Methods inherited from class io.micronaut.http.client.HttpClientConfiguration

    getAddressResolverGroupName, getAlpnModes, getChannelOptions, getConnectionPoolIdleTimeout, getConnectTimeout, getConnectTtl, getDefaultCharset, getDnsResolutionMode, getEventLoopGroup, getHttpVersion, getLoggerName, getLogLevel, getMaxChunkSize, getMaxContentLength, getMaxHeaderSize, getMaxInitialLineLength, getMaxRedirects, getNumOfThreads, getPcapLoggingPathPattern, getPlaintextMode, getProxyAddress, getProxyPassword, getProxySelector, getProxyType, getProxyUsername, getReadIdleTimeout, getReadTimeout, getRedirectAdditionalNonPreserveBodyFilteredHeaders, getRedirectAlwaysFilteredHeaders, getRedirectCrossOriginFilteredHeaders, getRequestTimeout, getShutdownQuietPeriod, getShutdownTimeout, getSslConfiguration, getThreadFactory, isAllowBlockEventLoop, isBufferErrorBodyForStreaming, isDecompressionEnabled, isExceptionOnErrorStatus, resolveProxy, setAddressResolverGroupName, setAllowBlockEventLoop, setAlpnModes, setBufferErrorBodyForStreaming, setChannelOptions, setConnectionPoolIdleTimeout, setConnectTimeout, setConnectTtl, setDecompressionEnabled, setDefaultCharset, setDnsResolutionMode, setEventLoopGroup, setExceptionOnErrorStatus, setHttpVersion, setLoggerName, setLogLevel, setMaxChunkSize, setMaxContentLength, setMaxHeaderSize, setMaxInitialLineLength, setMaxRedirects, setNumOfThreads, setPcapLoggingPathPattern, setPlaintextMode, setProxyAddress, setProxyPassword, setProxySelector, setProxyType, setProxyUsername, setReadIdleTimeout, setReadTimeout, setRedirectAdditionalNonPreserveBodyFilteredHeaders, setRedirectAlwaysFilteredHeaders, setRedirectCrossOriginFilteredHeaders, setRequestTimeout, setShutdownQuietPeriod, setShutdownTimeout, setSslConfiguration, setThreadFactory

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • NoRedirectHttpClientConfiguration

      public NoRedirectHttpClientConfiguration(@NonNull io.micronaut.http.client.HttpClientConfiguration delegate)
      Parameters:
      delegate - The configuration to copy the settings from.

  • Method Details

    • isFollowRedirects

      public boolean isFollowRedirects()
      Overrides:
      isFollowRedirects in class io.micronaut.http.client.HttpClientConfiguration
      Returns:
      Always false. Requests to the identity provider never follow redirects.

    • setFollowRedirects

      public void setFollowRedirects(boolean followRedirects)
      Ignored. Requests to the identity provider never follow redirects.
      Overrides:
      setFollowRedirects in class io.micronaut.http.client.HttpClientConfiguration
      Parameters:
      followRedirects - ignored

    • getConnectionPoolConfiguration

      public io.micronaut.http.client.HttpClientConfiguration.ConnectionPoolConfiguration getConnectionPoolConfiguration()
      Specified by:
      getConnectionPoolConfiguration in class io.micronaut.http.client.HttpClientConfiguration

    • getWebSocketCompressionConfiguration

      public @Nullable io.micronaut.http.client.HttpClientConfiguration.WebSocketCompressionConfiguration getWebSocketCompressionConfiguration()
      Overrides:
      getWebSocketCompressionConfiguration in class io.micronaut.http.client.HttpClientConfiguration

    • getHttp2Configuration

      public @Nullable io.micronaut.http.client.HttpClientConfiguration.Http2ClientConfiguration getHttp2Configuration()
      Overrides:
      getHttp2Configuration in class io.micronaut.http.client.HttpClientConfiguration