Skip to content

Add ssl.enabled property for HTTP client settings - #51835

Closed
sandeep780049 wants to merge 1 commit into
spring-projects:mainfrom
sandeep780049:ssl-enabled-property
Closed

sandeep780049 wants to merge 1 commit into
spring-projects:mainfrom
sandeep780049:ssl-enabled-property

Conversation

@sandeep780049

Copy link
Copy Markdown

Adds the missing `spring.http.clients.ssl.enabled` property (and the matching per-service-client property) to `HttpClientSettingsProperties.Ssl`, aligning HTTP client SSL configuration with every other `*.ssl.enabled` property in Spring Boot.

As noted in gh-51472 (surfaced during review of gh-51468), `HttpClientSettingsProperties.Ssl` only exposed `bundle`. There was no way to explicitly disable SSL when a bundle was inherited from base settings or configured at group level. This PR treats it as a bug of omission per @wilkinsona's direction on the issue:

  • `ssl.enabled=true` with no bundle: falls back to the JDK's default trust material (no bundle applied, so existing behavior is preserved)
  • `ssl.enabled=false`: acts as a kill switch — clears any SSL bundle, including one inherited via `orElse` from base settings, mirroring the semantics of e.g. `spring.data.redis.ssl.enabled=false` overriding `ssl.bundle`
  • `ssl.enabled=false` + `ssl.bundle=...`: the bundle is resolved and configured but then cleared, so no exception is thrown and SSL remains off

An earlier iteration applied the kill switch before the `orElse` merge, but that would have let a base-settings bundle resurrect itself through the null-bundle merge, so the clearing is deliberately applied after the merge.

Closes gh-51472

N/A

Yes — 4 new tests in `HttpClientSettingsPropertyMapperTests`:

  • `mapWhenSslEnabledWithNoBundleDoesNotSetSslBundle` — enabled with no bundle leaves bundle unset (JDK trust material)
  • `mapWhenSslEnabledUsesBundle` — enabled + bundle resolves the bundle
  • `mapWhenSslDisabledDoesNotSetSslBundle` — disabled + configured bundle does not throw and results in no bundle
  • `mapWhenSslDisabledOverridesBaseSettingsSslBundle` — disabled clears a bundle inherited from base settings

All 13 tests in the class pass, `checkFormat` passes, and the module compiles cleanly.

No.

Unlike every other *.ssl.enabled property in Spring Boot, the HTTP
client settings SSL configuration had no enabled flag, making it
impossible to explicitly disable SSL (for example when a base or
group-level bundle is configured but SSL should not be used).

A bug of omission as discussed in spring-projectsgh-51472: ssl.enabled=true with no
bundle falls back to the JDK's default trust material, while
ssl.enabled=false acts as a kill switch that clears any configured
bundle, mirroring the semantics used elsewhere such as
spring.data.redis.ssl.enabled.

Closes spring-projectsgh-51472

Signed-off-by: Sandeep yadav <224312127+sandeep780049@users.noreply.github.com>
@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Sep 18, 2026
@philwebb

Copy link
Copy Markdown
Member

Thanks for the pull-request, but as mentioned in the issue comments #51472 is currently labeled as pending-design-work which means we aren't ready to accept contributions.

@philwebb philwebb closed this Sep 18, 2026
@philwebb philwebb added status: declined A suggestion or change that we don't feel we should currently apply and removed status: waiting-for-triage An issue we've not yet triaged labels Sep 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: declined A suggestion or change that we don't feel we should currently apply

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Unlike other SSL properties, HttpClientSettingsProperties.Ssl has no enabled property

3 participants