org.springframework.remoting.httpinvoker

## Class HttpInvokerClientInterceptor

- java.lang.Object
- - org.springframework.remoting.support.RemotingSupport
  - - org.springframework.remoting.support.RemoteAccessor
    - - org.springframework.remoting.support.UrlBasedRemoteAccessor
      - - org.springframework.remoting.support.RemoteInvocationBasedAccessor
        - - org.springframework.remoting.httpinvoker.HttpInvokerClientInterceptor

- All Implemented Interfaces:
    Advice, Interceptor, MethodInterceptor, Aware, BeanClassLoaderAware, InitializingBean, HttpInvokerClientConfiguration
  Direct Known Subclasses:
    HttpInvokerProxyFactoryBean

  Deprecated.
  as of 5.3 (phasing out serialization-based remoting)

      @Deprecated
      public class HttpInvokerClientInterceptor
      extends RemoteInvocationBasedAccessor
      implements MethodInterceptor, HttpInvokerClientConfiguration

  `MethodInterceptor` for accessing an HTTP invoker service. The service URL must be an HTTP URL exposing an HTTP invoker service.

  Serializes remote invocation objects and deserializes remote invocation result objects. Uses Java serialization just like RMI, but provides the same ease of setup as Caucho's HTTP-based Hessian protocol.

  HTTP invoker is a very extensible and customizable protocol. It supports the RemoteInvocationFactory mechanism, like RMI invoker, allowing to include additional invocation attributes (for example, a security context). Furthermore, it allows to customize request execution via the `HttpInvokerRequestExecutor` strategy.

  Can use the JDK's `RMIClassLoader` to load classes from a given `codebase`, performing on-demand dynamic code download from a remote location. The codebase can consist of multiple URLs, separated by spaces. Note that RMIClassLoader requires a SecurityManager to be set, analogous to when using dynamic class download with standard RMI! (See the RMI documentation for details.)

  WARNING: Be aware of vulnerabilities due to unsafe Java deserialization: Manipulated input streams could lead to unwanted code execution on the server during the deserialization step. As a consequence, do not expose HTTP invoker endpoints to untrusted clients but rather just between your own services. In general, we strongly recommend any other message format (e.g. JSON) instead.

  Since:
    1.1
  Author:
    Juergen Hoeller
  See Also:
    `UrlBasedRemoteAccessor.setServiceUrl(java.lang.String)`, `setCodebaseUrl(java.lang.String)`, `RemoteInvocationBasedAccessor.setRemoteInvocationFactory(org.springframework.remoting.support.RemoteInvocationFactory)`, `setHttpInvokerRequestExecutor(org.springframework.remoting.httpinvoker.HttpInvokerRequestExecutor)`, `HttpInvokerServiceExporter`, `HttpInvokerProxyFactoryBean`, `RMIClassLoader`

- - ### Field Summary

    - ### Fields inherited from class org.springframework.remoting.support.RemotingSupport

      `logger`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `HttpInvokerClientInterceptor()` Deprecated.

  - ### Method Summary

    All Methods Instance Methods Concrete Methods Deprecated Methods
    Modifier and Type | Method and Description
    --- | ---
    `void` | `afterPropertiesSet()` Deprecated. Invoked by the containing `BeanFactory` after it has set all bean properties and satisfied `BeanFactoryAware`, `ApplicationContextAware` etc.
    `protected RemoteAccessException` | `convertHttpInvokerAccessException(Throwable ex)` Deprecated. Convert the given HTTP invoker access exception to an appropriate Spring `RemoteAccessException`.
    `protected RemoteInvocationResult` | `executeRequest(RemoteInvocation invocation)` Deprecated. Execute the given remote invocation via the `HttpInvokerRequestExecutor`.
    `protected RemoteInvocationResult` | `executeRequest(RemoteInvocation invocation, MethodInvocation originalInvocation)` Deprecated. Execute the given remote invocation via the `HttpInvokerRequestExecutor`.
    `String` | `getCodebaseUrl()` Deprecated. Return the codebase URL to download classes from if not found locally.
    `HttpInvokerRequestExecutor` | `getHttpInvokerRequestExecutor()` Deprecated. Return the HttpInvokerRequestExecutor used by this remote accessor.
    `Object` | `invoke(MethodInvocation methodInvocation)` Deprecated. Implement this method to perform extra treatments before and after the invocation.
    `void` | `setCodebaseUrl(String codebaseUrl)` Deprecated. Set the codebase URL to download classes from if not found locally.
    `void` | `setHttpInvokerRequestExecutor(HttpInvokerRequestExecutor httpInvokerRequestExecutor)` Deprecated. Set the HttpInvokerRequestExecutor implementation to use for executing remote invocations.

    - ### Methods inherited from class org.springframework.remoting.support.RemoteInvocationBasedAccessor

      `createRemoteInvocation, getRemoteInvocationFactory, recreateRemoteInvocationResult, setRemoteInvocationFactory`

    - ### Methods inherited from class org.springframework.remoting.support.UrlBasedRemoteAccessor

      `getServiceUrl, setServiceUrl`

    - ### Methods inherited from class org.springframework.remoting.support.RemoteAccessor

      `getServiceInterface, setServiceInterface`

    - ### Methods inherited from class org.springframework.remoting.support.RemotingSupport

      `getBeanClassLoader, overrideThreadContextClassLoader, resetThreadContextClassLoader, setBeanClassLoader`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

    - ### Methods inherited from interface org.springframework.remoting.httpinvoker.HttpInvokerClientConfiguration

      `getServiceUrl`

- - ### Constructor Detail

    - #### HttpInvokerClientInterceptor

          public HttpInvokerClientInterceptor()

      Deprecated.

  - ### Method Detail

    - #### setCodebaseUrl

          public void setCodebaseUrl(@Nullable
                                     String codebaseUrl)

      Deprecated.
      Set the codebase URL to download classes from if not found locally. Can consists of multiple URLs, separated by spaces.

      Follows RMI's codebase conventions for dynamic class download. In contrast to RMI, where the server determines the URL for class download (via the "java.rmi.server.codebase" system property), it's the client that determines the codebase URL here. The server will usually be the same as for the service URL, just pointing to a different path there.

      See Also:
        `UrlBasedRemoteAccessor.setServiceUrl(java.lang.String)`, `CodebaseAwareObjectInputStream`, `RMIClassLoader`

    - #### getCodebaseUrl

          @Nullable
          public String getCodebaseUrl()

      Deprecated.
      Return the codebase URL to download classes from if not found locally.
      Specified by:
        `getCodebaseUrl` in interface `HttpInvokerClientConfiguration`
      Returns:
        the codebase URL, or `null` if none
      See Also:
        `RMIClassLoader`

    - #### setHttpInvokerRequestExecutor

          public void setHttpInvokerRequestExecutor(HttpInvokerRequestExecutor httpInvokerRequestExecutor)

      Deprecated.
      Set the HttpInvokerRequestExecutor implementation to use for executing remote invocations.

      Default is `SimpleHttpInvokerRequestExecutor`. Alternatively, consider using `HttpComponentsHttpInvokerRequestExecutor` for more sophisticated needs.

      See Also:
        `SimpleHttpInvokerRequestExecutor`, `HttpComponentsHttpInvokerRequestExecutor`

    - #### getHttpInvokerRequestExecutor

          public HttpInvokerRequestExecutor getHttpInvokerRequestExecutor()

      Deprecated.
      Return the HttpInvokerRequestExecutor used by this remote accessor.

      Creates a default SimpleHttpInvokerRequestExecutor if no executor has been initialized already.

    - #### afterPropertiesSet

          public void afterPropertiesSet()

      Deprecated.
      Description copied from interface: `InitializingBean`
      Invoked by the containing `BeanFactory` after it has set all bean properties and satisfied `BeanFactoryAware`, `ApplicationContextAware` etc.

      This method allows the bean instance to perform validation of its overall configuration and final initialization when all bean properties have been set.

      Specified by:
        `afterPropertiesSet` in interface `InitializingBean`
      Overrides:
        `afterPropertiesSet` in class `UrlBasedRemoteAccessor`

    - #### invoke

          @Nullable
          public Object invoke(MethodInvocation methodInvocation)
                                  throws Throwable

      Deprecated.
      Description copied from interface: `MethodInterceptor`
      Implement this method to perform extra treatments before and after the invocation. Polite implementations would certainly like to invoke `Joinpoint.proceed()`.
      Specified by:
        `invoke` in interface `MethodInterceptor`
      Parameters:
        `methodInvocation` - the method invocation joinpoint
      Returns:
        the result of the call to `Joinpoint.proceed()`; might be intercepted by the interceptor
      Throws:
        `Throwable` - if the interceptors or the target object throws an exception

    - #### executeRequest

          protected RemoteInvocationResult executeRequest(RemoteInvocation invocation,
                                                          MethodInvocation originalInvocation)
                                                   throws Exception

      Deprecated.
      Execute the given remote invocation via the `HttpInvokerRequestExecutor`.

      This implementation delegates to `executeRequest(RemoteInvocation)`. Can be overridden to react to the specific original MethodInvocation.

      Parameters:
        `invocation` - the RemoteInvocation to execute
        `originalInvocation` - the original MethodInvocation (can e.g. be cast to the ProxyMethodInvocation interface for accessing user attributes)
      Returns:
        the RemoteInvocationResult object
      Throws:
        `Exception` - in case of errors

    - #### executeRequest

          protected RemoteInvocationResult executeRequest(RemoteInvocation invocation)
                                                   throws Exception

      Deprecated.
      Execute the given remote invocation via the `HttpInvokerRequestExecutor`.

      Can be overridden in subclasses to pass a different configuration object to the executor. Alternatively, add further configuration properties in a subclass of this accessor: By default, the accessor passed itself as configuration object to the executor.

      Parameters:
        `invocation` - the RemoteInvocation to execute
      Returns:
        the RemoteInvocationResult object
      Throws:
        `IOException` - if thrown by I/O operations
        `ClassNotFoundException` - if thrown during deserialization
        `Exception` - in case of general errors
      See Also:
        `getHttpInvokerRequestExecutor()`, `HttpInvokerClientConfiguration`

    - #### convertHttpInvokerAccessException

          @Nullable
          protected RemoteAccessException convertHttpInvokerAccessException(Throwable ex)

      Deprecated.
      Convert the given HTTP invoker access exception to an appropriate Spring `RemoteAccessException`.
      Parameters:
        `ex` - the exception to convert
      Returns:
        the RemoteAccessException to throw, or `null` to have the original exception propagated to the caller