use system props when creating the RestTransport by fer-marino · Pull Request #539 · weaviate/java-client

fer-marino · 2026-02-23T08:37:36Z

this is a simple pull request that enable the usage of system properties when creating a RestTransport client. This is particularly useful when you need to configure the HTTP client for edge cases, eg. using an http proxy:

-Dhttp.proxyHost=10.250.0.1 -Dhttp.proxyPort=33128

orca-security-eu

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 0 0	View in Orca
Passed	SAST	0 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

weaviate-git-bot · 2026-02-23T10:00:59Z

To avoid any confusion in the future about your contribution to Weaviate, we work with a Contributor License Agreement. If you agree, you can simply add a comment to this PR that you agree with the CLA so that we can merge.

beep boop - the Weaviate bot 👋🤖

PS:
Are you already a member of the Weaviate Forum?

bevzzz · 2026-02-23T10:22:10Z

Nice addition, thank you @fer-marino

orca-security-eu

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 0 0	View in Orca
Warning	SAST	1 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

🛡️ The following SAST misconfigurations have been detected

	NAME	FILE
	Prevent Server-Side Request Forgery (SSRF) via User Input in URLs	...ltGrpcTransport.java	View in code

Note: The scan should have failed if no policies were configured in warn-only mode.

fer-marino · 2026-03-02T14:09:35Z

oh sorry. I've added a lot more stuff. Using an http proxy proved much more difficult than I thought, so here is the implementation. I've also added an extra method for the OIDC authentication to use resourceOwnerPassword providing also a client secret id (needed if anon login is disabled)

bevzzz · 2026-03-06T21:02:59Z

@fer-marino it's been a busy week, but I'm going to get back to this PR first thing Monday. Appreciate you taking time to contribute!

Using an http proxy proved much more difficult than I thought

Could you please elaborate on the difficulties you ran into with configuring http proxy via system properties? I guess one limitation of that approach would be that it doesn't allow using a different proxy per client. Was there something else you encountered?

bevzzz

I suggest focusing this PR on adding proxy support and introduce ROPC authentication in a separate PR.

src/main/java/io/weaviate/client6/v1/internal/oidc/OidcUtils.java

src/main/java/io/weaviate/client6/v1/internal/Proxy.java

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/NimbusTokenProvider.java

src/main/java/io/weaviate/client6/v1/internal/oidc/OidcUtils.java

…ent PR comments.

fer-marino · 2026-03-09T09:54:53Z

hi, I've implemented most of your suggestions.

About my difficulties in implementing the proxy, is the different http libraries used by the different interfaces. My initial solution worked only for the rest transport, leaving out gRPC and OIDC authentication.

bevzzz · 2026-03-09T13:18:43Z

Thanks! Could you please rebase your branch on the latest main -- I've just merged a PR that should skip OIDC Client Credentials test if the secret is not available in the CI environment (which it isn't for outside contributions). All tests should be passing again then.

bevzzz

This is shaping up really well. Here are a couple more things I noticed.

Is there any simple test we could write for the HTTP / gRPC proxy configs? We're already using MockServer for some tests, can we extend the test suite to also verify request are being proxied correctly? e.g. using MockServer's proxying utility

src/main/java/io/weaviate/client6/v1/api/Authentication.java

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Flow.java

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/NimbusTokenProvider.java

bevzzz · 2026-03-09T13:27:16Z

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Flow.java

    return () -> grant; // Reuse cached authorization grant
  }

+  static Flow resourceOwnerPassword(String clientId, String clientSecret, String username, String password) {


Rename to resourceOwnerPasswordCredentials

src/main/java/io/weaviate/client6/v1/internal/oidc/OidcConfig.java

src/main/java/io/weaviate/client6/v1/internal/TokenProvider.java

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/NimbusTokenProvider.java

bevzzz · 2026-03-09T13:43:09Z

My initial solution worked only for the rest transport, leaving out gRPC and OIDC authentication.

Makes sense, yes. Thanks a lot for taking these two aspects into consideration.

Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

….java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

…usTokenProvider.java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

…java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

…usTokenProvider.java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

…entication

fer-marino · 2026-03-09T14:58:48Z

added some more test units, including one for the proxy. I've also modified the pom, as in my setup the lombok annotation processor was not getting invoked during unit tests execution.

src/test/java/io/weaviate/client6/v1/internal/rest/ProxyTest.java

src/main/java/io/weaviate/client6/v1/internal/oidc/OidcConfig.java

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Flow.java

src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/NimbusTokenProvider.java

bevzzz · 2026-03-09T16:02:54Z

src/test/java/io/weaviate/testutil/transport/MockRestTransport.java

+      this(ep == null ? "NULL" : ep.method(req), 
+           ep == null ? "NULL" : ep.requestUrl(req), 
+           ep == null ? "NULL" : ep.body(req), 
+           ep == null ? null : ep.queryParameters(req));


When would endpoint be null? The endpoint describes how to execute the request.

bevzzz · 2026-03-09T16:04:44Z

src/test/java/io/weaviate/testutil/transport/MockRestTransport.java

  }

  private List<Request<?>> requests = new ArrayList<>();
+  private Object nextResponse = null;


Seems like nextResponse is only ever set to null. If so, the condition on line 52 if (nextResponse != null) {...} is never going to fire. What do we need this field for?

pom.xml

bevzzz · 2026-03-09T16:09:12Z

added some more test units, including one for the proxy

Thank you 👍

…th AssertJ conventions

fer-marino · 2026-03-10T09:15:42Z

pushed another commit with your suggestions

use system props when creating the RestTransport

1e0dbaa

orca-security-eu bot reviewed Feb 23, 2026

View reviewed changes

bevzzz approved these changes Feb 23, 2026

View reviewed changes

add proxy support for OIDC and gRPC transport

312142c

orca-security-eu bot reviewed Mar 2, 2026

View reviewed changes

bevzzz requested changes Mar 9, 2026

View reviewed changes

refactor OIDC metadata handling and improve proxy integration. Implem…

12012ea

…ent PR comments.

bevzzz requested changes Mar 9, 2026

View reviewed changes

fer-marino and others added 7 commits March 9, 2026 14:47

Update src/main/java/io/weaviate/client6/v1/api/Authentication.java

f93a619

Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Update src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Flow…

05f5de9

….java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Update src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Nimb…

3f0d9e9

…usTokenProvider.java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Update src/main/java/io/weaviate/client6/v1/internal/TokenProvider.java

82e2ac6

Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Update src/main/java/io/weaviate/client6/v1/internal/oidc/OidcConfig.…

f0a558e

…java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

Update src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/Nimb…

82be962

…usTokenProvider.java Co-authored-by: dyma solovei <53943884+bevzzz@users.noreply.github.com>

add unit tests for proxy integration and resource owner password auth…

6f41ca2

…entication

bevzzz requested changes Mar 9, 2026

View reviewed changes

remove Lombok dependency, refactor proxy handling, and align tests wi…

dd8398d

…th AssertJ conventions

Conversation

fer-marino commented Feb 23, 2026

Uh oh!

orca-security-eu bot left a comment

Choose a reason for hiding this comment

Orca Security Scan Summary

Uh oh!

weaviate-git-bot commented Feb 23, 2026

Uh oh!

bevzzz commented Feb 23, 2026

Uh oh!

orca-security-eu bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Orca Security Scan Summary

Uh oh!

fer-marino commented Mar 2, 2026

Uh oh!

bevzzz commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bevzzz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fer-marino commented Mar 9, 2026

Uh oh!

bevzzz commented Mar 9, 2026

Uh oh!

bevzzz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bevzzz Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bevzzz commented Mar 9, 2026

Uh oh!

fer-marino commented Mar 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bevzzz Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

bevzzz Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bevzzz commented Mar 9, 2026

Uh oh!

fer-marino commented Mar 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

orca-security-eu bot left a comment •

edited

Loading

bevzzz commented Mar 6, 2026 •

edited

Loading