Add SSL bundle support to WebClient auto-configuration

Introduce `WebClientSsl` interface and auto-configuration to allow a
WebClient builder to have custom SSL configuration applied.

The previous `ClientHttpConnectorConfiguration` has been been changed
to now create `ClientHttpConnectorFactory` instances which can be used
directly or by `AutoConfiguredWebClientSsl`.

Closes gh-18556

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/function/client/AbstractClientHttpConnectorFactoryTests.java

@@ -0,0 +1,104 @@
+/*
+ * Copyright 2012-2023 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.autoconfigure.web.reactive.function.client;
+
+import org.junit.jupiter.api.Test;
+
+import org.springframework.boot.ssl.SslBundle;
+import org.springframework.boot.ssl.SslBundleKey;
+import org.springframework.boot.ssl.jks.JksSslStoreBundle;
+import org.springframework.boot.ssl.jks.JksSslStoreDetails;
+import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
+import org.springframework.boot.web.server.Ssl;
+import org.springframework.boot.web.server.Ssl.ClientAuth;
+import org.springframework.boot.web.server.WebServer;
+import org.springframework.web.reactive.function.client.WebClient;
+import org.springframework.web.reactive.function.client.WebClientRequestException;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+
+/**
+ * Abstract base class for {@link ClientHttpConnectorFactory} tests.
+ *
+ * @author Phillip Webb
+ */
+abstract class AbstractClientHttpConnectorFactoryTests {
+
+	@Test
+	void insecureConnection() {
+		TomcatServletWebServerFactory webServerFactory = new TomcatServletWebServerFactory(0);
+		WebServer webServer = webServerFactory.getWebServer();
+		try {
+			webServer.start();
+			int port = webServer.getPort();
+			String url = "http://localhost:%s".formatted(port);
+			WebClient insecureWebClient = WebClient.builder()
+				.clientConnector(getFactory().createClientHttpConnector())
+				.build();
+			String insecureBody = insecureWebClient.get()
+				.uri(url)
+				.exchangeToMono((response) -> response.bodyToMono(String.class))
+				.block();
+			assertThat(insecureBody).contains("HTTP Status 404 – Not Found");
+		}
+		finally {
+			webServer.stop();
+		}
+	}
+
+	@Test
+	void secureConnection() throws Exception {
+		TomcatServletWebServerFactory webServerFactory = new TomcatServletWebServerFactory(0);
+		Ssl ssl = new Ssl();
+		ssl.setClientAuth(ClientAuth.NEED);
+		ssl.setKeyPassword("password");
+		ssl.setKeyStore("classpath:test.jks");
+		ssl.setTrustStore("classpath:test.jks");
+		webServerFactory.setSsl(ssl);
+		WebServer webServer = webServerFactory.getWebServer();
+		try {
+			webServer.start();
+			int port = webServer.getPort();
+			String url = "https://localhost:%s".formatted(port);
+			WebClient insecureWebClient = WebClient.builder()
+				.clientConnector(getFactory().createClientHttpConnector())
+				.build();
+			assertThatExceptionOfType(WebClientRequestException.class).isThrownBy(() -> insecureWebClient.get()
+				.uri(url)
+				.exchangeToMono((response) -> response.bodyToMono(String.class))
+				.block());
+			JksSslStoreDetails storeDetails = JksSslStoreDetails.forLocation("classpath:test.jks");
+			JksSslStoreBundle stores = new JksSslStoreBundle(storeDetails, storeDetails);
+			SslBundle sslBundle = SslBundle.of(stores, SslBundleKey.of("password"));
+			WebClient secureWebClient = WebClient.builder()
+				.clientConnector(getFactory().createClientHttpConnector(sslBundle))
+				.build();
+			String secureBody = secureWebClient.get()
+				.uri(url)
+				.exchangeToMono((response) -> response.bodyToMono(String.class))
+				.block();
+			assertThat(secureBody).contains("HTTP Status 404 – Not Found");
+		}
+		finally {
+			webServer.stop();
+		}
+	}
+
+	protected abstract ClientHttpConnectorFactory<?> getFactory();
+
+}

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/function/client/ClientHttpConnectorAutoConfigurationTests.java

@@ -52,11 +52,11 @@ class ClientHttpConnectorAutoConfigurationTests {
 	void whenReactorIsAvailableThenReactorBeansAreDefined() {
 		this.contextRunner.run((context) -> {
 			BeanDefinition customizerDefinition = context.getBeanFactory()
-				.getBeanDefinition("clientConnectorCustomizer");
+				.getBeanDefinition("webClientHttpConnectorCustomizer");
 			assertThat(customizerDefinition.isLazyInit()).isTrue();
-			BeanDefinition connectorDefinition = context.getBeanFactory()
-				.getBeanDefinition("reactorClientHttpConnector");
+			BeanDefinition connectorDefinition = context.getBeanFactory().getBeanDefinition("webClientHttpConnector");
 			assertThat(connectorDefinition.isLazyInit()).isTrue();
+			assertThat(context).hasBean("reactorClientHttpConnectorFactory");
 			assertThat(context).hasSingleBean(ReactorResourceFactory.class);
 		});
 	}
@@ -65,11 +65,12 @@ class ClientHttpConnectorAutoConfigurationTests {
 	void whenReactorIsUnavailableThenJettyBeansAreDefined() {
 		this.contextRunner.withClassLoader(new FilteredClassLoader(HttpClient.class)).run((context) -> {
 			BeanDefinition customizerDefinition = context.getBeanFactory()
-				.getBeanDefinition("clientConnectorCustomizer");
+				.getBeanDefinition("webClientHttpConnectorCustomizer");
 			assertThat(customizerDefinition.isLazyInit()).isTrue();
-			BeanDefinition connectorDefinition = context.getBeanFactory().getBeanDefinition("jettyClientHttpConnector");
+			BeanDefinition connectorDefinition = context.getBeanFactory().getBeanDefinition("webClientHttpConnector");
 			assertThat(connectorDefinition.isLazyInit()).isTrue();
 			assertThat(context).hasBean("jettyClientResourceFactory");
+			assertThat(context).hasBean("jettyClientHttpConnectorFactory");
 		});
 	}
 
@@ -78,11 +79,12 @@ class ClientHttpConnectorAutoConfigurationTests {
 		this.contextRunner.withClassLoader(new FilteredClassLoader(HttpClient.class, ReactiveRequest.class))
 			.run((context) -> {
 				BeanDefinition customizerDefinition = context.getBeanFactory()
-					.getBeanDefinition("clientConnectorCustomizer");
+					.getBeanDefinition("webClientHttpConnectorCustomizer");
 				assertThat(customizerDefinition.isLazyInit()).isTrue();
 				BeanDefinition connectorDefinition = context.getBeanFactory()
-					.getBeanDefinition("httpComponentsClientHttpConnector");
+					.getBeanDefinition("webClientHttpConnector");
 				assertThat(connectorDefinition.isLazyInit()).isTrue();
+				assertThat(context).hasBean("httpComponentsClientHttpConnectorFactory");
 			});
 	}
 
@@ -92,11 +94,12 @@ class ClientHttpConnectorAutoConfigurationTests {
 			.withClassLoader(new FilteredClassLoader(HttpClient.class, ReactiveRequest.class, HttpAsyncClients.class))
 			.run((context) -> {
 				BeanDefinition customizerDefinition = context.getBeanFactory()
-					.getBeanDefinition("clientConnectorCustomizer");
+					.getBeanDefinition("webClientHttpConnectorCustomizer");
 				assertThat(customizerDefinition.isLazyInit()).isTrue();
 				BeanDefinition connectorDefinition = context.getBeanFactory()
-					.getBeanDefinition("jdkClientHttpConnector");
+					.getBeanDefinition("webClientHttpConnector");
 				assertThat(connectorDefinition.isLazyInit()).isTrue();
+				assertThat(context).hasBean("jdkClientHttpConnectorFactory");
 			});
 	}
 
@@ -104,7 +107,7 @@ class ClientHttpConnectorAutoConfigurationTests {
 	void shouldCreateHttpClientBeans() {
 		this.contextRunner.run((context) -> {
 			assertThat(context).hasSingleBean(ReactorResourceFactory.class);
-			assertThat(context).hasSingleBean(ReactorClientHttpConnector.class);
+			assertThat(context).hasSingleBean(ClientHttpConnector.class);
 			WebClientCustomizer clientCustomizer = context.getBean(WebClientCustomizer.class);
 			WebClient.Builder builder = mock(WebClient.Builder.class);
 			clientCustomizer.customize(builder);
@@ -115,7 +118,18 @@ class ClientHttpConnectorAutoConfigurationTests {
 	@Test
 	void shouldNotOverrideCustomClientConnector() {
 		this.contextRunner.withUserConfiguration(CustomClientHttpConnectorConfig.class).run((context) -> {
-			assertThat(context).hasSingleBean(ClientHttpConnector.class)
+			assertThat(context).hasSingleBean(ClientHttpConnector.class).hasBean("customConnector");
+			WebClientCustomizer clientCustomizer = context.getBean(WebClientCustomizer.class);
+			WebClient.Builder builder = mock(WebClient.Builder.class);
+			clientCustomizer.customize(builder);
+			then(builder).should().clientConnector(any(ClientHttpConnector.class));
+		});
+	}
+
+	@Test
+	void shouldNotOverrideCustomClientConnectorFactory() {
+		this.contextRunner.withUserConfiguration(CustomClientHttpConnectorFactoryConfig.class).run((context) -> {
+			assertThat(context).hasSingleBean(ClientHttpConnectorFactory.class)
 				.hasBean("customConnector")
 				.doesNotHaveBean(ReactorResourceFactory.class);
 			WebClientCustomizer clientCustomizer = context.getBean(WebClientCustomizer.class);
@@ -128,7 +142,7 @@ class ClientHttpConnectorAutoConfigurationTests {
 	@Test
 	void shouldUseCustomReactorResourceFactory() {
 		this.contextRunner.withUserConfiguration(CustomReactorResourceConfig.class)
-			.run((context) -> assertThat(context).hasSingleBean(ReactorClientHttpConnector.class)
+			.run((context) -> assertThat(context).hasSingleBean(ClientHttpConnector.class)
 				.hasSingleBean(ReactorResourceFactory.class)
 				.hasBean("customReactorResourceFactory"));
 	}
@@ -143,6 +157,16 @@ class ClientHttpConnectorAutoConfigurationTests {
 
 	}
 
+	@Configuration(proxyBeanMethods = false)
+	static class CustomClientHttpConnectorFactoryConfig {
+
+		@Bean
+		ClientHttpConnectorFactory<?> customConnector() {
+			return (sslBundle) -> mock(ClientHttpConnector.class);
+		}
+
+	}
+
 	@Configuration(proxyBeanMethods = false)
 	static class CustomReactorResourceConfig {
 

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/function/client/ClientHttpConnectorFactoryConfigurationTests.java

@@ -34,12 +34,12 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.mock;
 
 /**
- * Tests for {@link ClientHttpConnectorConfiguration}.
+ * Tests for {@link ClientHttpConnectorFactoryConfiguration}.
  *
  * @author Phillip Webb
  * @author Brian Clozel
  */
-class ClientHttpConnectorConfigurationTests {
+class ClientHttpConnectorFactoryConfigurationTests {
 
 	@Test
 	void jettyClientHttpConnectorAppliesJettyResourceFactory() {
@@ -50,7 +50,8 @@ class ClientHttpConnectorConfigurationTests {
 		jettyResourceFactory.setExecutor(executor);
 		jettyResourceFactory.setByteBufferPool(byteBufferPool);
 		jettyResourceFactory.setScheduler(scheduler);
-		JettyClientHttpConnector connector = getClientHttpConnector(jettyResourceFactory);
+		JettyClientHttpConnectorFactory connectorFactory = getJettyClientHttpConnectorFactory(jettyResourceFactory);
+		JettyClientHttpConnector connector = connectorFactory.createClientHttpConnector();
 		HttpClient httpClient = (HttpClient) ReflectionTestUtils.getField(connector, "httpClient");
 		assertThat(httpClient.getExecutor()).isSameAs(executor);
 		assertThat(httpClient.getByteBufferPool()).isSameAs(byteBufferPool);
@@ -61,24 +62,26 @@ class ClientHttpConnectorConfigurationTests {
 	void JettyResourceFactoryHasSslContextFactory() {
 		// gh-16810
 		JettyResourceFactory jettyResourceFactory = new JettyResourceFactory();
-		JettyClientHttpConnector connector = getClientHttpConnector(jettyResourceFactory);
+		JettyClientHttpConnectorFactory connectorFactory = getJettyClientHttpConnectorFactory(jettyResourceFactory);
+		JettyClientHttpConnector connector = connectorFactory.createClientHttpConnector();
 		HttpClient httpClient = (HttpClient) ReflectionTestUtils.getField(connector, "httpClient");
 		assertThat(httpClient.getSslContextFactory()).isNotNull();
 	}
 
-	private JettyClientHttpConnector getClientHttpConnector(JettyResourceFactory jettyResourceFactory) {
-		ClientHttpConnectorConfiguration.JettyClient jettyClient = new ClientHttpConnectorConfiguration.JettyClient();
+	private JettyClientHttpConnectorFactory getJettyClientHttpConnectorFactory(
+			JettyResourceFactory jettyResourceFactory) {
+		ClientHttpConnectorFactoryConfiguration.JettyClient jettyClient = new ClientHttpConnectorFactoryConfiguration.JettyClient();
 		// We shouldn't usually call this method directly since it's on a non-proxy config
-		return ReflectionTestUtils.invokeMethod(jettyClient, "jettyClientHttpConnector", jettyResourceFactory);
+		return ReflectionTestUtils.invokeMethod(jettyClient, "jettyClientHttpConnectorFactory", jettyResourceFactory);
 	}
 
 	@Test
 	void shouldApplyHttpClientMapper() {
 		new ReactiveWebApplicationContextRunner()
-			.withConfiguration(AutoConfigurations.of(ClientHttpConnectorConfiguration.ReactorNetty.class))
+			.withConfiguration(AutoConfigurations.of(ClientHttpConnectorFactoryConfiguration.ReactorNetty.class))
 			.withUserConfiguration(CustomHttpClientMapper.class)
 			.run((context) -> {
-				context.getBean("reactorClientHttpConnector");
+				context.getBean(ReactorClientHttpConnectorFactory.class).createClientHttpConnector();
 				assertThat(CustomHttpClientMapper.called).isTrue();
 			});
 	}

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/function/client/HttpComponentsClientHttpConnectorFactoryTests.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright 2012-2023 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.autoconfigure.web.reactive.function.client;
+
+/**
+ * Tests for {@link HttpComponentsClientHttpConnectorFactory}.
+ *
+ * @author Phillip Webb
+ */
+class HttpComponentsClientHttpConnectorFactoryTests extends AbstractClientHttpConnectorFactoryTests {
+
+	@Override
+	protected ClientHttpConnectorFactory<?> getFactory() {
+		return new HttpComponentsClientHttpConnectorFactory();
+	}
+
+}

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/function/client/JdkClientHttpConnectorFactoryTests.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright 2012-2023 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.autoconfigure.web.reactive.function.client;
+
+/**
+ * Tests for {@link JdkClientHttpConnectorFactory}.
+ *
+ * @author Phillip Webb
+ */
+class JdkClientHttpConnectorFactoryTests extends AbstractClientHttpConnectorFactoryTests {
+
+	@Override
+	protected ClientHttpConnectorFactory<?> getFactory() {
+		return new JdkClientHttpConnectorFactory();
+	}
+
+}

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/function/client/JettyClientHttpConnectorFactoryTests.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright 2012-2023 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.autoconfigure.web.reactive.function.client;
+
+import org.springframework.http.client.reactive.JettyResourceFactory;
+
+/**
+ * Tests for {@link JettyClientHttpConnectorFactory}.
+ *
+ * @author Phillip Webb
+ */
+class JettyClientHttpConnectorFactoryTests extends AbstractClientHttpConnectorFactoryTests {
+
+	@Override
+	protected ClientHttpConnectorFactory<?> getFactory() {
+		JettyResourceFactory resourceFactory = new JettyResourceFactory();
+		return new JettyClientHttpConnectorFactory(resourceFactory);
+	}
+
+}

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/function/client/ReactorClientHttpConnectorFactoryTests.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2012-2023 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.autoconfigure.web.reactive.function.client;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+
+import org.springframework.http.client.reactive.ReactorResourceFactory;
+
+/**
+ * Tests for {@link ReactorClientHttpConnectorFactory}.
+ *
+ * @author Phillip Webb
+ */
+class ReactorClientHttpConnectorFactoryTests extends AbstractClientHttpConnectorFactoryTests {
+
+	private ReactorResourceFactory resourceFactory;
+
+	@BeforeEach
+	void setup() {
+		this.resourceFactory = new ReactorResourceFactory();
+		this.resourceFactory.afterPropertiesSet();
+	}
+
+	@AfterEach
+	void teardown() {
+		this.resourceFactory.destroy();
+	}
+
+	@Override
+	protected ClientHttpConnectorFactory<?> getFactory() {
+		return new ReactorClientHttpConnectorFactory(this.resourceFactory);
+	}
+
+}

spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/function/client/WebClientAutoConfigurationTests.java

@@ -19,6 +19,7 @@ package org.springframework.boot.autoconfigure.web.reactive.function.client;
 import org.junit.jupiter.api.Test;
 
 import org.springframework.boot.autoconfigure.AutoConfigurations;
+import org.springframework.boot.autoconfigure.ssl.SslAutoConfiguration;
 import org.springframework.boot.test.context.runner.ApplicationContextRunner;
 import org.springframework.boot.web.codec.CodecCustomizer;
 import org.springframework.boot.web.reactive.function.client.WebClientCustomizer;
@@ -39,8 +40,9 @@ import static org.mockito.Mockito.mock;
  */
 class WebClientAutoConfigurationTests {
 
-	private final ApplicationContextRunner contextRunner = new ApplicationContextRunner().withConfiguration(
-			AutoConfigurations.of(ClientHttpConnectorAutoConfiguration.class, WebClientAutoConfiguration.class));
+	private final ApplicationContextRunner contextRunner = new ApplicationContextRunner()
+		.withConfiguration(AutoConfigurations.of(ClientHttpConnectorAutoConfiguration.class,
+				WebClientAutoConfiguration.class, SslAutoConfiguration.class));
 
 	@Test
 	void shouldCreateBuilder() {
@@ -91,6 +93,14 @@ class WebClientAutoConfigurationTests {
 			});
 	}
 
+	@Test
+	void shouldCreateWebClientSsl() {
+		this.contextRunner.run((context) -> {
+			WebClientSsl webClientSsl = context.getBean(WebClientSsl.class);
+			assertThat(webClientSsl).isInstanceOf(AutoConfiguredWebClientSsl.class);
+		});
+	}
+
 	@Configuration(proxyBeanMethods = false)
 	static class CodecConfiguration {