Apply cookie handling to reactive HttpComponents connector

The spring.http.clients.cookie-handling property and
HttpClientSettings.cookieHandling() were honored by every imperative
ClientHttpRequestFactoryBuilder and by the Jetty, JDK and Reactor
ClientHttpConnectorBuilders, but HttpComponentsHttpAsyncClientBuilder
ignored the setting. As a result, a WebClient backed by Apache
HttpComponents kept storing cookies even when cookie handling was
disabled.

Map the setting to the default request config's cookie spec, as
HttpComponentsHttpClientBuilder already does, and document the property
alongside the other global HTTP client settings.

See gh-51724

Signed-off-by: Hyun Lee <dlwhdugs4147@gmail.com>
This commit is contained in:
Hyun Lee
2026-09-15 13:22:25 +01:00
committed by Andy Wilkinson
parent a8f1a99f7d
commit fa8ecccc37
4 changed files with 49 additions and 5 deletions
@@ -364,6 +364,7 @@ You can use properties to configure aspects such as:
* Any default headers that should be sent.
* API versioning configuration.
* Redirect settings.
* Cookie handling settings.
* Connection and read timeouts.
* SSL bundles to use.
@@ -428,6 +429,7 @@ These include:
* Connection Timeouts.
* Read Timeouts.
* How HTTP redirects should be handled.
* How HTTP cookies should be handled.
* Which SSL bundle should be used when connecting.
These common settings are represented by the javadoc:org.springframework.boot.http.client.HttpClientSettings[] class which can be passed into the `build(...)` methods of javadoc:org.springframework.boot.http.client.reactive.ClientHttpConnectorBuilder[] and javadoc:org.springframework.boot.http.client.ClientHttpRequestFactoryBuilder[].
@@ -442,8 +444,14 @@ spring:
connect-timeout: 2s
read-timeout: 1s
redirects: dont-follow
cookie-handling: disable
----
When `spring.http.clients.cookie-handling` is not set, the default cookie handling of the underlying HTTP client library is used.
These defaults vary: for example, the Apache HttpComponents and Jetty clients store cookies and send them with subsequent requests whereas the JDK client ignores them.
When cookie handling is enabled, each underlying HTTP client instance uses its own cookie store.
Reactor Netty and the `simple` request factory do not support cookie handling so `enable` will fail with those clients and `enable-when-possible` will leave them unchanged.
[[io.rest-client.global-configuration.inetaddress-filtering]]