use system props when creating the RestTransport by fer-marino · Pull Request #539 · weaviate/java-client

fer-marino · 2026-02-23T08:37:36Z

this is a simple pull request that enable the usage of system properties when creating a RestTransport client. This is particularly useful when you need to configure the HTTP client for edge cases, eg. using an http proxy:

-Dhttp.proxyHost=10.250.0.1 -Dhttp.proxyPort=33128

orca-security-eu

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 0 0	View in Orca
Passed	SAST	0 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

weaviate-git-bot · 2026-02-23T10:00:59Z

To avoid any confusion in the future about your contribution to Weaviate, we work with a Contributor License Agreement. If you agree, you can simply add a comment to this PR that you agree with the CLA so that we can merge.

beep boop - the Weaviate bot 👋🤖

PS:
Are you already a member of the Weaviate Forum?

bevzzz · 2026-02-23T10:22:10Z

Nice addition, thank you @fer-marino

orca-security-eu

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 0 0	View in Orca
Warning	SAST	1 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

🛡️ The following SAST misconfigurations have been detected

	NAME	FILE
	Prevent Server-Side Request Forgery (SSRF) via User Input in URLs	...ltGrpcTransport.java	View in code

Note: The scan should have failed if no policies were configured in warn-only mode.

fer-marino · 2026-03-02T14:09:35Z

oh sorry. I've added a lot more stuff. Using an http proxy proved much more difficult than I thought, so here is the implementation. I've also added an extra method for the OIDC authentication to use resourceOwnerPassword providing also a client secret id (needed if anon login is disabled)

bevzzz · 2026-03-06T21:02:59Z

@fer-marino it's been a busy week, but I'm going to get back to this PR first thing Monday. Appreciate you taking time to contribute!

Using an http proxy proved much more difficult than I thought

Could you please elaborate on the difficulties you ran into with configuring http proxy via system properties? I guess one limitation of that approach would be that it doesn't allow using a different proxy per client. Was there something else you encountered?

bevzzz

I suggest focusing this PR on adding proxy support and introduce ROPC authentication in a separate PR.

src/main/java/io/weaviate/client6/v1/internal/oidc/OidcUtils.java

src/main/java/io/weaviate/client6/v1/internal/Proxy.java

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/NimbusTokenProvider.java

src/main/java/io/weaviate/client6/v1/internal/oidc/OidcUtils.java

…ent PR comments.

fer-marino · 2026-03-09T09:54:53Z

hi, I've implemented most of your suggestions.

About my difficulties in implementing the proxy, is the different http libraries used by the different interfaces. My initial solution worked only for the rest transport, leaving out gRPC and OIDC authentication.

bevzzz · 2026-03-09T13:18:43Z

Thanks! Could you please rebase your branch on the latest main -- I've just merged a PR that should skip OIDC Client Credentials test if the secret is not available in the CI environment (which it isn't for outside contributions). All tests should be passing again then.

bevzzz

This is shaping up really well. Here are a couple more things I noticed.

Is there any simple test we could write for the HTTP / gRPC proxy configs? We're already using MockServer for some tests, can we extend the test suite to also verify request are being proxied correctly? e.g. using MockServer's proxying utility

src/main/java/io/weaviate/client6/v1/api/Authentication.java

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Flow.java

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/NimbusTokenProvider.java

bevzzz · 2026-03-09T13:27:16Z

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Flow.java

    return () -> grant; // Reuse cached authorization grant
  }

+  static Flow resourceOwnerPassword(String clientId, String clientSecret, String username, String password) {


Rename to resourceOwnerPasswordCredentials

src/main/java/io/weaviate/client6/v1/internal/oidc/OidcConfig.java

src/main/java/io/weaviate/client6/v1/internal/TokenProvider.java

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/NimbusTokenProvider.java

bevzzz · 2026-03-09T13:43:09Z

My initial solution worked only for the rest transport, leaving out gRPC and OIDC authentication.

Makes sense, yes. Thanks a lot for taking these two aspects into consideration.

Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

….java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

…usTokenProvider.java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

…java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

…usTokenProvider.java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

…entication

fer-marino · 2026-03-09T14:58:48Z

added some more test units, including one for the proxy. I've also modified the pom, as in my setup the lombok annotation processor was not getting invoked during unit tests execution.

bevzzz · 2026-03-09T15:31:31Z

src/test/java/io/weaviate/client6/v1/internal/rest/ProxyTest.java

+    // Since WeaviateClient performs REST calls in constructor, we want to ensure
+    // that we separate the verification. 
+    // ProxyTest's setUp already created a client which did REST calls via proxy.
+


This comment looks misplaced -- we've already verified the proxy works before (or failed the test)

bevzzz · 2026-03-09T15:32:15Z

src/test/java/io/weaviate/client6/v1/internal/rest/ProxyTest.java

+    // In this test, we verify that the client has the proxy configured.
+    org.junit.Assert.assertNotNull(client.getConfig().proxy());
+    org.junit.Assert.assertEquals((long) proxyServer.getLocalPort(), (long) client.getConfig().proxy().port());


Should this be its own test case? Seems like these assertions aren't directly related to gRPC transport. Additionally, let's stick to assertj.Assertions for test assertions.

bevzzz · 2026-03-09T15:39:18Z

src/test/java/io/weaviate/client6/v1/internal/rest/ProxyTest.java

+    try {
+      // Perform a gRPC call.
+      client.collections.use("Test").size();
+    } catch (Exception e) {
+      // If we reach here, it means the client (and its gRPC transport)
+      // was successfully initialized and attempted a call.
+      // The "Network closed" error in logs confirms that gRPC tried to connect.
+    }


Is there a way we can narrow down this assertion? Right now any exception thrown by CollectionHandle::size is interpreted as "the test succeeded"; we should distill some condition to tell us if the exception was thrown for the right reason. I included a suggestion below.

The "Network closed" error in logs confirms that gRPC tried to connect.

Are these logs visible anywhere and/or can be asserted? For example:

Assertions.assertThatThrownBy(() -> client.collections.use("Test").size()) .isInstanceOf(WeaviateTransportException.class) .hasMessageContaining("Network closed");

If not, then I suggest we remove that comment as it is not clear which logs its referring to.

bevzzz · 2026-03-09T15:53:54Z

src/main/java/io/weaviate/client6/v1/internal/oidc/OidcConfig.java

+    public static OidcProxy from(Proxy proxy) {
+      return proxy == null ? null : new OidcProxy(proxy.host(), proxy.port(), proxy.scheme());
+    }


Suggested change

public static OidcProxy from(Proxy proxy) {

return proxy == null ? null : new OidcProxy(proxy.host(), proxy.port(), proxy.scheme());

}

public OidcProxy(Proxy proxy) {

this(requireNonNull(proxy, "proxy is null").scheme(), proxy.host(), proxy.port());

}

Feels like proxy == null ? null will be causing ambiguity at the call site. IMO a less ambiguous contract would be "create a non-null OidcProxy from a non-null Proxy".

See another comment about the ordering of parameters.

bevzzz · 2026-03-09T15:54:25Z

src/main/java/io/weaviate/client6/v1/internal/oidc/OidcConfig.java

+  public record OidcProxy(
+      String host,
+      int port,
+      String scheme) {


nit: similarly to Proxy, can we order the parameters as scheme, host, port?

bevzzz · 2026-03-09T15:58:38Z

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Flow.java


+  static Flow resourceOwnerPasswordCredentials(String clientId, String clientSecret, String username, String password) {
+    return new Flow() {   
+      private final AuthorizationGrant GRANT = new ResourceOwnerPasswordCredentialsGrant(username, new Secret(password));


Suggested change

private final AuthorizationGrant GRANT = new ResourceOwnerPasswordCredentialsGrant(username, new Secret(password));

private static final AuthorizationGrant GRANT = new ResourceOwnerPasswordCredentialsGrant(username, new Secret(password));

sorry, I must've missed that in my original suggestion

bevzzz · 2026-03-09T15:59:26Z

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/NimbusTokenProvider.java

-  private final OIDCProviderMetadata metadata;
+  private final AuthorizationServerMetadata metadata;


Why is this change necessary?

bevzzz · 2026-03-09T16:02:54Z

src/test/java/io/weaviate/testutil/transport/MockRestTransport.java

+      this(ep == null ? "NULL" : ep.method(req), 
+           ep == null ? "NULL" : ep.requestUrl(req), 
+           ep == null ? "NULL" : ep.body(req), 
+           ep == null ? null : ep.queryParameters(req));


When would endpoint be null? The endpoint describes how to execute the request.

bevzzz · 2026-03-09T16:04:44Z

src/test/java/io/weaviate/testutil/transport/MockRestTransport.java

  }

  private List<Request<?>> requests = new ArrayList<>();
+  private Object nextResponse = null;


Seems like nextResponse is only ever set to null. If so, the condition on line 52 if (nextResponse != null) {...} is never going to fire. What do we need this field for?

bevzzz · 2026-03-09T16:07:44Z

pom.xml

+          <configuration>
+            <annotationProcessorPaths>
+              <path>
+                <groupId>org.projectlombok</groupId>
+                <artifactId>lombok</artifactId>
+                <version>${lombok.version}</version>
+              </path>
+            </annotationProcessorPaths>
+          </configuration>


This project doesn't use Lombok for generating getters/setters. If you apply the suggestion about getConfig() in WeaviateClient.java then this configuration will probably become redundant.

bevzzz · 2026-03-09T16:09:12Z

added some more test units, including one for the proxy

Thank you 👍

use system props when creating the RestTransport

1e0dbaa

orca-security-eu bot reviewed Feb 23, 2026

View reviewed changes

bevzzz approved these changes Feb 23, 2026

View reviewed changes

add proxy support for OIDC and gRPC transport

312142c

orca-security-eu bot reviewed Mar 2, 2026

View reviewed changes

bevzzz requested changes Mar 9, 2026

View reviewed changes

refactor OIDC metadata handling and improve proxy integration. Implem…

12012ea

…ent PR comments.

bevzzz requested changes Mar 9, 2026

View reviewed changes

fer-marino and others added 7 commits March 9, 2026 14:47

Update src/main/java/io/weaviate/client6/v1/api/Authentication.java

f93a619

Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Update src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Flow…

05f5de9

….java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Update src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Nimb…

3f0d9e9

…usTokenProvider.java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Update src/main/java/io/weaviate/client6/v1/internal/TokenProvider.java

82e2ac6

Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Update src/main/java/io/weaviate/client6/v1/internal/oidc/OidcConfig.…

f0a558e

…java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Update src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Nimb…

82be962

…usTokenProvider.java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

add unit tests for proxy integration and resource owner password auth…

6f41ca2

…entication

bevzzz requested changes Mar 9, 2026

View reviewed changes

	private final AuthorizationGrant GRANT = new ResourceOwnerPasswordCredentialsGrant(username, new Secret(password));
	private static final AuthorizationGrant GRANT = new ResourceOwnerPasswordCredentialsGrant(username, new Secret(password));

		private final OIDCProviderMetadata metadata;
		private final AuthorizationServerMetadata metadata;

Conversation

fer-marino commented Feb 23, 2026

Uh oh!

orca-security-eu bot left a comment

Choose a reason for hiding this comment

Orca Security Scan Summary

Uh oh!

weaviate-git-bot commented Feb 23, 2026

Uh oh!

bevzzz commented Feb 23, 2026

Uh oh!

orca-security-eu bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Orca Security Scan Summary

Uh oh!

fer-marino commented Mar 2, 2026

Uh oh!

bevzzz commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bevzzz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fer-marino commented Mar 9, 2026

Uh oh!

bevzzz commented Mar 9, 2026

Uh oh!

bevzzz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bevzzz commented Mar 9, 2026

Uh oh!

fer-marino commented Mar 9, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bevzzz commented Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

orca-security-eu bot left a comment •

edited

Loading

bevzzz commented Mar 6, 2026 •

edited

Loading