How to avoid SSL validation in Spring restclient
May 07, 2024
Here is an example to disable SSL validation while calling https based URL
package com.techtx.testproject;
import org.apache.hc.client5.http.impl.DefaultHttpRequestRetryStrategy;
import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
import org.apache.hc.client5.http.impl.classic.HttpClients;
import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;
import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
import org.apache.hc.client5.http.io.HttpClientConnectionManager;
import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactoryBuilder;
import org.apache.hc.client5.http.ssl.TrustAllStrategy;
import org.apache.hc.core5.ssl.SSLContexts;
import org.apache.hc.core5.util.TimeValue;
import org.springframework.http.ResponseEntity;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.web.client.RestClient;
import javax.net.ssl.SSLContext;
import java.security.KeyManagementException;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
public class ApiIntfService {
public String callAPI()
{
final SSLContext sslContext;
try {
sslContext = SSLContexts.custom().loadTrustMaterial(null, new TrustAllStrategy()).build();
} catch (NoSuchAlgorithmException e) {
throw new RuntimeException(e);
} catch (KeyManagementException e) {
throw new RuntimeException(e);
} catch (KeyStoreException e) {
throw new RuntimeException(e);
}
final SSLConnectionSocketFactory socketFactory = SSLConnectionSocketFactoryBuilder
.create().setSslContext(sslContext).build();
final HttpClientConnectionManager cm = PoolingHttpClientConnectionManagerBuilder
.create().setSSLSocketFactory(socketFactory)
.build();
CloseableHttpClient httpClient = HttpClients.custom()
.setConnectionManager(cm)
.setRetryStrategy(new DefaultHttpRequestRetryStrategy(3, TimeValue.ofMilliseconds(1000)))
.evictExpiredConnections().build();
HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory();
requestFactory.setHttpClient(httpClient);
RestClient restClient = RestClient.builder().requestFactory(requestFactory).build();
ResponseEntity entity = restClient.get().uri("https://api.restful-api.dev/objects")
.retrieve()
.toEntity(String.class);
System.out.println(entity.getStatusCode());
System.out.println(entity.getBody());
return entity.getBody();
}
}
Here the apache httpclient is used as request factory and included in pom xml as dependency.
<dependency>
<groupId>org.apache.httpcomponents.client5</groupId>
<artifactId>httpclient5</artifactId>
<version>5.3.1</version>
</dependency>