Add WebFilter + Native Netty Support [SPR-16793]

[spring-projects-issues]

Rob Winch opened SPR-16793 and commented

It would be very nice to support WebFilter + Native Netty support. If we could do this, then it would be possible to support Spring Security + Netty applications.

---

Affects: 5.0.5

[spring-projects-issues]

Rossen Stoyanchev commented

That amounts to adding support for Netty as a server in WebFlux, but without using Reactor Netty, and it makes no sense for us to replicate what Reactor Netty provides on top of Netty.

If this is related to gRPC, as I suspect it is, I don't think this request helps in any way. The WebHandler API is for HTTP. gRPC runs on HTTP/2 as a transport, but exposes an RPC/messaging API on top with no HTTP concepts. As I commented on the gRPC ticket #20905, the Salesforce reactive-grpc project is likely a better starting point for gRPC support.

 

[spring-projects-issues]

Rob Winch commented

This is not necessarily related to a gRPC application. I'm thinking this makes sense for any application that is coding directly against Netty and wants to continue to use Netty APIs internally and work with WebFilter implementations (i.e. leveraging Spring Security). This means a raw Netty application could not leverage Spring Security.

[spring-projects-issues]

Rob Winch commented

For reference, here is a request that was made to use Spring Security with Netty spring-projects/spring-security#5259

[spring-projects-issues]

Rossen Stoyanchev commented

The user on the referenced ticket seems to be confused -- including starter-web and starter-webflux is meant to bring up a Servlet container with Spring MVC.

[spring-projects-issues]

Rossen Stoyanchev commented

To summarize, our support for Netty goes through Reactor Netty:

+----------------+
| WebHandler API |
+----------------+
| Reactor Netty  |
+-----------------
|     Netty      |
+----------------+

To adapt directly to Netty, we need an equivalent Reactive Streams layer:

+----------------+
| WebHandler API |
+----------------+
|      ???       |
+-----------------
|     Netty      |
+----------------+

We're never going to duplicate Reactor Netty. It's our foundation for Netty support.

Back to the stated goal to expand Spring Security's reach into other framework and applications beyond WebFlux. Those should be divided into categories:

1. Reactive Streams APIs, e.g. Ratpack, reactive-grpc
2. callback-based async APIs, e.g. Netty

Support for 1) is theoretically within reach because the underlying framework already exposes a Reactive Streams layer and API. For example it's probably not too hard to implement ServerWebExchange, ServerHttpRequest, and ServerHttpResponse based on Ratpack's request and response. That would let you invoke a WebFilter. However such support makes little sense in the Spring Framework because a) there is no need for yet another way to run on Netty, and b) Ratpack would be hidden behind adapters, not exposed to applications.

Support for 2) is harder at this point since Spring Security is built on a reactive foundation. You would also need a Reactive Streams layer. So I wouldn't consider this in the absence of any concrete cases.