Document disabling protocol upgrade in Apache Client

[stephenmontgomery]

Describe the bug
Updating from Spring Boot 3.3.6 to Spring Boot 3.4, has lead to Feign returning 403/FORBIDDEN for every Feign call, for every FeignClient call.

Spring Boot 3.4.0
Spring Cloud Dependencies: 2024.0.0
Spring Cloud OpenFeign: 4.2.0
Apache Http Client5: 5.13.5

Rolling back to previous SB 3.3.6 version:
Spring Boot 3.3.6
Spring Cloud Dependencies: 2023.0.4
Spring Cloud OpenFeign: 4.1.4
Apache Http Client5: 5.3.1

gives:

No change to the component being called by Feign - it's still deployed/processing/unchanged. There are no error messages/exceptions in either component ie either the caller or callee - there is nothing to suggest any issue.

application.yml:

spring:
  cloud:
    openfeign:
      compression:
        request:
          enabled: true
        response:
          enabled: true

Has this been seen before? Any further troubleshooting steps I can do?

Thanks.

[OlgaMaciaszek]

Hello, @stephenmontgomery, thanks for reporting the issue. Please provide a minimal, complete, verifiable example that reproduces the issue.

[stephenmontgomery]

Hi @OlgaMaciaszek,
Yeah can't do that, unfortunately - it's only reproducible in our deployed environments - k8s with istio + envoy. Works fine with the same components deployed in my local docker compose.

Just tried https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.4-Release-Notes#apache-http-components-and-envoy without any luck.

[OlgaMaciaszek]

Hi @stephenmontgomery, there's only a single issue that comes to mind at this point that could be related in terms of changing the way the request is created: #1070 - you can see if those upstream changes are not affecting you and change the prop if they are. If this is not the case, you may want to enable full logging on the client side in SC OF (https://docs.spring.io/spring-cloud-openfeign/reference/spring-cloud-openfeign.html#spring-cloud-feign-overriding-defaults) on both versions and compare the requests to see what's changed.

[stephenmontgomery]

Hi @OlgaMaciaszek,
We do have that configurer.setUseTrailingSlashMatch(true) SB 3 workaround littered everywhere so prob not it but I'll double-check. There def doesn't seem to be any trailing slash in the Feign logs above.

Bit further on here though, with some of our Operations team's input - they found something similar with istio/istio#53239 - outlines the 403 behaviour even though using http and not https. As mentioned above, I did try https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.4-Release-Notes#apache-http-components-and-envoy - which should have workedaround this issue but it had no effect so I'm wondering if the default config didn't take.

I'm also considering downgrading the HC5 version. As per spring-projects/spring-boot#43139, this TLS stuff came in HC5 5.4. As mentioned above, the last SB 3.3.6 version used HC5 5.3.1

[OlgaMaciaszek]

I don't have a better suggestion than for you to compare the full requests on both versions. Once you identify the issue (i.e. what has changed and is breaking you, we can take a look at how to resolve it).