fix: bypass proxy for Runtime API HTTP calls - #629
Conversation
There was a problem hiding this comment.
Pull request overview
This PR ensures that Java HttpURLConnection calls made by the Runtime Interface Client to RAPID (Runtime API) endpoints bypass any customer-configured JVM HTTP proxy, preventing internal Runtime API traffic from being incorrectly routed through a proxy.
Changes:
- Open Runtime API
HttpURLConnectioninstances withProxy.NO_PROXYvia a newcreateConnection(...)helper. - Add a unit test that sets
http.proxyHost/http.proxyPortand verifies Runtime API calls are not routed through the proxy.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| aws-lambda-java-runtime-interface-client/src/main/java/com/amazonaws/services/lambda/runtime/api/client/runtimeapi/LambdaRuntimeApiClientImpl.java | Route doGet/doPost through a new createConnection that uses Proxy.NO_PROXY to bypass JVM proxy settings. |
| aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/runtime/api/client/runtimeapi/LambdaRuntimeApiClientImplTest.java | Adds a regression test asserting Runtime API HTTP calls bypass a configured proxy. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Use Proxy.NO_PROXY when opening HttpURLConnection to RAPID endpoints. This prevents customer-configured http.proxyHost from routing internal Runtime API calls through the proxy, which fails when RAPID is not on a loopback address (localhost is implicitly exempt in most proxy implementations). The hot path (nextInvocation/postInvocationResponse) already bypasses Java's ProxySelector via the native C++/libcurl NativeClient and is not affected. Proxy.NO_PROXY is per-connection scoped, zero impact on customer handler HTTP calls.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
Suppressed comments (2)
aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/runtime/api/client/runtimeapi/LambdaRuntimeApiClientImplTest.java:588
- If you set
http.nonProxyHostsfor determinism, it also needs to be restored in thefinallyblock alongsidehttp.proxyHost/http.proxyPortto avoid leaking global JVM state into other tests.
if (previousProxyPort != null) {
System.setProperty("http.proxyPort", previousProxyPort);
} else {
System.clearProperty("http.proxyPort");
}
aws-lambda-java-runtime-interface-client/src/test/java/com/amazonaws/services/lambda/runtime/api/client/runtimeapi/LambdaRuntimeApiClientImplTest.java:564
- This test relies on Java using the configured proxy for the non-loopback address, but the JVM can also bypass proxies via the
http.nonProxyHostssystem property (often set in CI environments). To make the test deterministic and ensure it would fail if proxy routing occurs, explicitly sethttp.nonProxyHoststo a non-matching value for the duration of the test (and restore it infinally).
This issue also appears on line 584 of the same file.
String previousProxyHost = System.getProperty("http.proxyHost");
String previousProxyPort = System.getProperty("http.proxyPort");
System.setProperty("http.proxyHost", fakeProxy.getHostName());
System.setProperty("http.proxyPort", String.valueOf(fakeProxy.getPort()));
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #629 +/- ##
=========================================
Coverage 65.38% 65.38%
- Complexity 212 213 +1
=========================================
Files 34 34
Lines 991 991
Branches 143 143
=========================================
Hits 648 648
Misses 290 290
Partials 53 53 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Issue #, if available:
Description of changes:
Use Proxy.NO_PROXY when opening HttpURLConnection to RAPID endpoints. This prevents customer-configured http.proxyHost from routing internal Runtime API calls through the proxy, which fails when RAPID is not on a loopback address (localhost is implicitly exempt in most proxy implementations).
The hot path (nextInvocation/postInvocationResponse) already bypasses Java's ProxySelector via the native C++/libcurl NativeClient and is not affected.
Proxy.NO_PROXY is per-connection scoped, zero impact on customer handler HTTP calls.
Target : both OCI and Managed Runtime
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.