NoPrivateNetworkHttpClient not honoring wrapped client's max_redirects #65978

Ping @nicolas-grekas as GIT hinted that you recently worked on it :-)

This is a decoration order issue: with decorates: 'foo.client' and no decoration_priority, your decorator becomes the outermost one, so it runs before the ScopingHttpClient that carries the max_redirects: 0 you configured.

A higher decoration priority means "closer to the transport". Scoped clients are built as a decoration stack:

// 1. ThrottlingHttpClient (5)   -> throttles requests
// 2. UriTemplateHttpClient (10) -> expands URI templates
// 3. ScopingHttpClient (15)     -> resolves relative URLs and applies scope configuration
// 4. CachingHttpClient (20)     -> caches responses
// 5. RetryableHttpClient (25)   -> retries requests
// 6. TraceableHttpClient (100)  -> traces requests

At the default priority of 0, your decorator sits outside all of these. It therefore sees the raw $options given by the caller and merges the contract defaults (max_redirects => 20) into them. The scoped max_redirects: 0 is a default of the inner client, and since the option is now set explicitly, it is not applied anymore.

Give the decorator a priority above the others so that it sits close to the transport:

foo.client.private:
    class: Symfony\Component\HttpClient\NoPrivateNetworkHttpClient
    decorates: 'foo.client'
    decoration_priority: 200
    arguments: ['@.inner']

ScopingHttpClient then runs first, the decorator receives options that already contain max_redirects: 0, and no redirect is followed. The same goes for timeout, verify_peer, default headers, etc, which are shadowed the same way in the outermost position.

That placement is also the one you want for the check itself. As the outermost decorator, NoPrivateNetworkHttpClient validates the URL before UriTemplateHttpClient expands it and before ScopingHttpClient resolves it against base_uri, which means it checks something other than the URL that is eventually requested (both currently fail closed, and a relative URL against a scoped base_uri throws Invalid URL: scheme is missing). As the innermost decorator, it checks the final URL.

One case is not covered by reordering: options declared under framework.http_client.default_options are constructor defaults of http_client.transport, so they live below every decorator and are still shadowed.