Spring Framework 5.3.x is incompatible with Jetty 10 (Client)

[mikebell90]

We have recently moved to Spring Boot 2.7.5 with Jetty 10 (or are trying to).

What we found was two things - one is probably not relevant, that you have to manually manage the reactive-httpclient adapter for jetty to 2.x (would be nice if this were documented), but more importantly, the JettyHeadersAdapter class in org.spring.framework.http.client.reactive is compatible with Jetty 9 but not Jetty 10.

We received errors like :

java.lang.IncompatibleClassChangeError: Found interface org.eclipse.jetty.http.HttpFields, but class was expected
	at org.springframework.http.client.reactive.JettyHeadersAdapter.toSingleValueMap(JettyHeadersAdapter.java:86)

digging further, we find the JettyHeaderAdapter class imports org.eclipse.jetty.http.HttpFields and indeed this changed from a class in Jetty 9 to an interface in Jetty 10+.

methods such as

public void add(String key, @Nullable String value) {
		this.headers.add(key, value); // headers is an HttpFields instance
	}

fail because of this

You fixed issues for Jetty 11/12 which were identical in https://github.com/spring-projects/spring-framework/blob/d84ca2ba90d27a7c63d7b35a6259b5b9cf341118/spring-web/src/main/java/org/springframework/http/client/reactive/JettyHeadersAdapter.java

however this fix (which would be more involved because it would have to sniff for Jetty 10 and instantiate a different JettyHeadersAdapter) has not been backported.

[jhoeller]

We actually have such Jetty 10 sniffing and a corresponding JettyHeadersAdapter bypass for the server variant in 5.3.x, just not for the client part, it seems. Let's see what we can do about it for Jetty 10 on the client side.

[poutsma]

We have recently moved to Spring Boot 2.7.5 with Jetty 10 (or are trying to).

@mikebell90 We always recommend upgrading to the latest version of Spring Boot, which is currently 2.7.8. Earlier versions might lack important security fixes.

We actually have such Jetty 10 sniffing and a corresponding JettyHeadersAdapter bypass for the server variant in 5.3.x, just not for the client part, it seems.

@jhoeller We do, see https://github.com/spring-projects/spring-framework/blob/5.3.x/spring-web/src/main/java/org/springframework/http/client/reactive/JettyClientHttpResponse.java#L80, and in my personal tests with Boot 2.7.8 and Jetty 10.0.13, it seems to work fine.

@mikebell90 I cannot reproduce this issue. You might want to check your classpath, and make sure that it only has Jetty 10 jars on it. Otherwise, can you provide a complete, minimal sample (something that we can unzip or git clone, build, and deploy) that reproduces this problem?

[mikebell90]

But what about

spring-framework/spring-web/src/main/java/org/springframework/http/client/reactive/JettyClientHttpRequest.java

Line 147 in e4e90bb

return HttpHeaders.readOnlyHttpHeaders(new JettyHeadersAdapter(this.jettyRequest.getHeaders()));

Which does not have such a sniff

[poutsma]

Which does not have such a sniff

Indeed, though that code is pretty hard to trigger, and is only invoked when inspecting the request post exchange.

At any rate, this is now fixed, see 21c3d4f