puppetlabs / clj-http-client

HTTP client library wrapping Apache HttpAsyncClient
Apache License 2.0
15 stars 30 forks source link

(PE-34843) Properly reuse connections with a client cert #98

Closed nicklewis closed 1 year ago

nicklewis commented 1 year ago

The apache http client library has the concept of "stateless" and "stateful" connections, where a stateful connection is one made with an associated user identity (either NTLM or an SSL certificate). The default implementation tracks this information (which it refers to as the "user token") on the HTTP context and uses it to avoid reusing a connection when the user token has changed.

Because we create a new HTTP context for every request, we don't properly track that token, meaning each time the client tries to reuse a connection, it finds that the token has changed (it thinks the old value is null, the the new value is not null) and rejects the connection. This creates a substantial performance hit in cases where we make many requests in a row.

Because we define the SSL context at the time the client is created and not when it's used, it's impossible for it to change between requests. Therefore, we can simply disable the connection state tracking feature entirely.