Spring Gateway中配置多个Netty HttpClient的实现方案咨询

Spring Gateway完全支持配置多个Netty HttpClient并根据场景按需选择，也可以在过滤器层面动态调整SslContext，以下是具体实现方案：

一、先配置多个HttpClient Bean #

提前定义两个客户端实例，分别对应mTLS场景和常规TLS/无SSL场景：

@Bean("mtlsHttpClient")
public HttpClient mtlsHttpClient() {
    final PrivateKey privateKey = getPrivateKey();
    final X509Certificate x509Certificate = getX509Certificate();

    final SslContext sslContext =
        SslContextBuilder.forClient()
            .trustManager(InsecureTrustManagerFactory.INSTANCE)
            .keyManager(privateKey, x509Certificate)
            .build();

    return HttpClient.create().secure(spec -> spec.sslContext(sslContext));
}

@Bean("regularHttpClient")
public HttpClient regularHttpClient() {
    // 常规TLS配置（默认行为），若需完全禁用SSL可去掉.secure()
    return HttpClient.create();
}

二、方案1：通过自定义GatewayFilter切换HttpClient #

编写过滤器，根据请求特征（路径、请求头、路由元数据等）选择对应客户端，替换默认客户端：

@Component
public class DynamicHttpClientFilter implements GatewayFilterFactory<DynamicHttpClientFilter.Config> {

    private final HttpClient regularHttpClient;

    public DynamicHttpClientFilter(@Qualifier("regularHttpClient") HttpClient regularHttpClient) {
        this.regularHttpClient = regularHttpClient;
    }

    @Override
    public GatewayFilter apply(Config config) {
        return (exchange, chain) -> {
            // 示例：根据请求路径判断是否使用常规客户端
            boolean useRegularClient = exchange.getRequest().getPath().startsWithSegments("/non-mtls");
            if (useRegularClient) {
                // 将选中的客户端放入Exchange属性，覆盖默认实例
                exchange.getAttributes().put(NettyRoutingFilter.HTTP_CLIENT_ATTR, regularHttpClient);
            }
            return chain.filter(exchange);
        };
    }

    public static class Config {
        // 可配置匹配规则等参数
    }
}

在路由配置中绑定过滤器：

spring:
  cloud:
    gateway:
      routes:
        - id: mtls_route
          uri: https://mtls-server.example.com
          predicates:
            - Path=/mtls/**
        - id: regular_route
          uri: https://regular-server.example.com
          predicates:
            - Path=/non-mtls/**
          filters:
            - name: DynamicHttpClientFilter

三、方案2：通过自定义HttpClientFactory全局动态选择 #

实现HttpClientFactory接口，根据路由元数据动态返回对应客户端，更适合全局统一管控场景：

@Component
public class DynamicHttpClientFactory implements HttpClientFactory {

    private final HttpClient mtlsHttpClient;
    private final HttpClient regularHttpClient;

    public DynamicHttpClientFactory(@Qualifier("mtlsHttpClient") HttpClient mtlsHttpClient,
                                   @Qualifier("regularHttpClient") HttpClient regularHttpClient) {
        this.mtlsHttpClient = mtlsHttpClient;
        this.regularHttpClient = regularHttpClient;
    }

    @Override
    public HttpClient getHttpClient(ServerWebExchange exchange) {
        // 从路由元数据中判断客户端类型
        Route route = exchange.getAttribute(GATEWAY_ROUTE_ATTR);
        if (route != null && "mtls".equals(route.getMetadata().get("clientType"))) {
            return mtlsHttpClient;
        }
        return regularHttpClient;
    }
}

在路由配置中添加元数据标识：

spring:
  cloud:
    gateway:
      routes:
        - id: mtls_route
          uri: https://mtls-server.example.com
          predicates:
            - Path=/mtls/**
          metadata:
            clientType: mtls
        - id: regular_route
          uri: https://regular-server.example.com
          predicates:
            - Path=/non-mtls/**
          metadata:
            clientType: regular

四、方案3：过滤器内动态修改SslContext #

如果不想维护多个HttpClient实例，也可以在过滤器中临时修改现有客户端的SslContext：

@Component
public class DynamicSslFilter implements GatewayFilterFactory<DynamicSslFilter.Config> {

    private final HttpClient defaultHttpClient;

    public DynamicSslFilter(HttpClient defaultHttpClient) {
        this.defaultHttpClient = defaultHttpClient;
    }

    @Override
    public GatewayFilter apply(Config config) {
        return (exchange, chain) -> {
            boolean disableMtls = exchange.getRequest().getPath().startsWithSegments("/non-mtls");
            if (disableMtls) {
                // 重置为常规TLS的SslContext
                HttpClient modifiedClient = defaultHttpClient.secure(spec -> {
                    spec.sslContext(SslContextBuilder.forClient().build());
                });
                exchange.getAttributes().put(NettyRoutingFilter.HTTP_CLIENT_ATTR, modifiedClient);
            }
            return chain.filter(exchange);
        };
    }

    public static class Config {}
}

注意：此方案每次会创建新的HttpClient实例，性能不如提前配置多个Bean复用，仅适合临时场景。

内容的提问来源于stack exchange，提问作者Javato