Skip to content

Commit 401b9ef

Browse files
ldetmerldetmer
committed
chore: update apahce http transport clients to use default jdk certs
1 parent c0a4d8a commit 401b9ef

4 files changed

Lines changed: 23 additions & 37 deletions

File tree

‎docs/oauth-2.0.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ For instructions on setting up your credentials properly, see the
4747
already have an access token, you can make a request in the following way:
4848

4949
```java
50-
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
50+
import com.google.api.client.http.javanet.NetHttpTransport;
5151
import com.google.api.client.json.gson.GsonFactory;
5252
import com.google.api.services.books.Books;
5353
import com.google.auth.http.HttpCredentialsAdapter;
@@ -59,7 +59,7 @@ GoogleCredentials credentials =
5959

6060
Books books =
6161
new Books.Builder(
62-
GoogleNetHttpTransport.newTrustedTransport(),
62+
Gnew NetHttpTransport(),
6363
GsonFactory.getDefaultInstance(),
6464
new HttpCredentialsAdapter(credentials))
6565
.setApplicationName("BooksExample/1.0")
@@ -79,7 +79,7 @@ App Engine takes care of all of the details. You only specify the OAuth 2.0
7979
scope you need.
8080

8181
```java
82-
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
82+
import com.google.api.client.http.javanet.NetHttpTransport;
8383
import com.google.api.client.json.gson.GsonFactory;
8484
import com.google.api.services.books.Books;
8585
import com.google.appengine.api.appidentity.AppIdentityService;
@@ -99,7 +99,7 @@ GoogleCredentials credentials =
9999

100100
Books books =
101101
new Books.Builder(
102-
GoogleNetHttpTransport.newTrustedTransport(),
102+
new NetHttpTransport(),
103103
GsonFactory.getDefaultInstance(),
104104
new HttpCredentialsAdapter(credentials))
105105
.setApplicationName("BooksExample/1.0")
@@ -373,7 +373,7 @@ a private key downloaded from the [Google API Console][console].
373373
For example, you can make a request in the following way:
374374

375375
```java
376-
HttpTransport httpTransport = GoogleNetHttpTransport.newTrustedTransport();
376+
HttpTransport httpTransport = new NetHttpTransport();
377377
JsonFactory jsonFactory = GsonFactory.getDefaultInstance();
378378

379379
//Build service account credential
@@ -405,12 +405,12 @@ additionally call [`GoogleCredential.Builder.setServiceAccountUser(String)`][set
405405

406406
This is the command-line authorization code flow described in [Using OAuth 2.0 for Installed Applications][oauth2-installed-app].
407407

408-
Example snippet from [plus-cmdline-sample][plus-sample]:
408+
Example usage:
409409

410410
```java
411411
public static void main(String[] args) {
412412
try {
413-
httpTransport = GoogleNetHttpTransport.newTrustedTransport();
413+
httpTransport = new NetHttpTransport();
414414
dataStoreFactory = new FileDataStoreFactory(DATA_STORE_DIR);
415415
// authorization
416416
Credential credential = authorize();

‎google-api-client-apache-v5/src/main/java/com/google/api/client/googleapis/apache/v5/GoogleApache5HttpTransport.java‎

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,8 @@
1414

1515
package com.google.api.client.googleapis.apache.v5;
1616

17-
import com.google.api.client.googleapis.GoogleUtils;
1817
import com.google.api.client.googleapis.mtls.MtlsProvider;
1918
import com.google.api.client.googleapis.mtls.MtlsUtils;
20-
import com.google.api.client.googleapis.util.Utils;
2119
import com.google.api.client.http.apache.v5.Apache5HttpTransport;
2220
import com.google.api.client.util.SslUtils;
2321
import com.google.common.annotations.Beta;
@@ -48,11 +46,8 @@
4846
public final class GoogleApache5HttpTransport {
4947

5048
/**
51-
* Returns a new instance of {@link Apache5HttpTransport} that uses {@link
52-
* GoogleUtils#getCertificateTrustStore()} for the trusted certificates. If
53-
* `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to "true", and the default
54-
* client certificate key store from {@link Utils#loadDefaultMtlsKeyStore()} is not null, then the
55-
* transport uses the default client certificate and is mutual TLS.
49+
* Returns a new instance of {@link Apache5HttpTransport} that uses default jdk certificates for
50+
* the trusted certificates.
5651
*/
5752
public static Apache5HttpTransport newTrustedTransport()
5853
throws GeneralSecurityException, IOException {
@@ -61,9 +56,8 @@ public static Apache5HttpTransport newTrustedTransport()
6156

6257
/**
6358
* {@link Beta} <br>
64-
* Returns a new instance of {@link Apache5HttpTransport} that uses {@link
65-
* GoogleUtils#getCertificateTrustStore()} for the trusted certificates. mtlsProvider can be used
66-
* to configure mutual TLS for the transport.
59+
* Returns a new instance of {@link Apache5HttpTransport} that uses default jdk certificates
60+
* for the trusted certificates. mtlsProvider can be used to configure mutual TLS for the transport.
6761
*
6862
* @param mtlsProvider MtlsProvider to configure mutual TLS for the transport
6963
*/
@@ -109,22 +103,20 @@ public SocketFactoryRegistryHandler(MtlsProvider mtlsProvider)
109103
mtlsKeyStorePassword = mtlsProvider.getKeyStorePassword();
110104
}
111105

112-
// Use the included trust store
113-
KeyStore trustStore = GoogleUtils.getCertificateTrustStore();
114106
SSLContext sslContext = SslUtils.getTlsSslContext();
115107

116108
if (mtlsKeyStore != null && mtlsKeyStorePassword != null) {
117109
this.isMtls = true;
118110
SslUtils.initSslContext(
119111
sslContext,
120-
trustStore,
112+
null,
121113
SslUtils.getPkixTrustManagerFactory(),
122114
mtlsKeyStore,
123115
mtlsKeyStorePassword,
124116
SslUtils.getDefaultKeyManagerFactory());
125117
} else {
126118
this.isMtls = false;
127-
SslUtils.initSslContext(sslContext, trustStore, SslUtils.getPkixTrustManagerFactory());
119+
SslUtils.initSslContext(sslContext, null, SslUtils.getPkixTrustManagerFactory());
128120
}
129121
LayeredConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(sslContext);
130122

‎google-api-client-apache-v5/src/test/java/com/google/api/client/googleapis/apache/v5/ITGoogleApache5HttpTransportTest.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,11 @@
3030
public class ITGoogleApache5HttpTransportTest {
3131

3232
@Test
33-
public void testHttpRequestFailsWhenMakingRequestToSiteWithoutGoogleCerts()
33+
public void testHttpRequestFailsWhenMakingRequestToSiteWithoutDefaultJdkCerts()
3434
throws GeneralSecurityException, IOException {
3535
Apache5HttpTransport apache5HttpTransport = GoogleApache5HttpTransport.newTrustedTransport();
36-
HttpGet httpGet = new HttpGet("https://maven.com/");
36+
// Use a self-signed certificate site that won't be trusted by default trust store
37+
HttpGet httpGet = new HttpGet("https://self-signed.badssl.com/");
3738
Exception exception = null;
3839
try {
3940
apache5HttpTransport
@@ -43,7 +44,7 @@ public void testHttpRequestFailsWhenMakingRequestToSiteWithoutGoogleCerts()
4344
new HttpClientResponseHandler<Void>() {
4445
@Override
4546
public Void handleResponse(ClassicHttpResponse response) {
46-
fail("Should not have been able to complete SSL request on non google site.");
47+
fail("Should not have been able to complete SSL request with untrusted cert.");
4748
return null;
4849
}
4950
});

‎google-api-client/src/main/java/com/google/api/client/googleapis/apache/v2/GoogleApacheHttpTransport.java‎

Lines changed: 6 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,8 @@
1414

1515
package com.google.api.client.googleapis.apache.v2;
1616

17-
import com.google.api.client.googleapis.GoogleUtils;
1817
import com.google.api.client.googleapis.mtls.MtlsProvider;
1918
import com.google.api.client.googleapis.mtls.MtlsUtils;
20-
import com.google.api.client.googleapis.util.Utils;
2119
import com.google.api.client.http.apache.v2.ApacheHttpTransport;
2220
import com.google.api.client.util.Beta;
2321
import com.google.api.client.util.SslUtils;
@@ -47,11 +45,8 @@
4745
public final class GoogleApacheHttpTransport {
4846

4947
/**
50-
* Returns a new instance of {@link ApacheHttpTransport} that uses {@link
51-
* GoogleUtils#getCertificateTrustStore()} for the trusted certificates. If
52-
* `GOOGLE_API_USE_CLIENT_CERTIFICATE` environment variable is set to "true", and the default
53-
* client certificate key store from {@link Utils#loadDefaultMtlsKeyStore()} is not null, then the
54-
* transport uses the default client certificate and is mutual TLS.
48+
* Returns a new instance of {@link ApacheHttpTransport} that uses default jdk certs for the
49+
* trusted certificates.
5550
*/
5651
public static ApacheHttpTransport newTrustedTransport()
5752
throws GeneralSecurityException, IOException {
@@ -60,8 +55,8 @@ public static ApacheHttpTransport newTrustedTransport()
6055

6156
/**
6257
* {@link Beta} <br>
63-
* Returns a new instance of {@link ApacheHttpTransport} that uses {@link
64-
* GoogleUtils#getCertificateTrustStore()} for the trusted certificates. mtlsProvider can be used
58+
* Returns a new instance of {@link ApacheHttpTransport} that default jdk certs for the
59+
* trusted certificates. mtlsProvider can be used
6560
* to configure mutual TLS for the transport.
6661
*
6762
* @param mtlsProvider MtlsProvider to configure mutual TLS for the transport
@@ -105,22 +100,20 @@ public SocketFactoryRegistryHandler(MtlsProvider mtlsProvider)
105100
mtlsKeyStorePassword = mtlsProvider.getKeyStorePassword();
106101
}
107102

108-
// Use the included trust store
109-
KeyStore trustStore = GoogleUtils.getCertificateTrustStore();
110103
SSLContext sslContext = SslUtils.getTlsSslContext();
111104

112105
if (mtlsKeyStore != null && mtlsKeyStorePassword != null) {
113106
this.isMtls = true;
114107
SslUtils.initSslContext(
115108
sslContext,
116-
trustStore,
109+
null,
117110
SslUtils.getPkixTrustManagerFactory(),
118111
mtlsKeyStore,
119112
mtlsKeyStorePassword,
120113
SslUtils.getDefaultKeyManagerFactory());
121114
} else {
122115
this.isMtls = false;
123-
SslUtils.initSslContext(sslContext, trustStore, SslUtils.getPkixTrustManagerFactory());
116+
SslUtils.initSslContext(sslContext, null, SslUtils.getPkixTrustManagerFactory());
124117
}
125118
LayeredConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(sslContext);
126119

0 commit comments

Comments
 (0)