Deprecate remoting technologies support

Because of security and broader industry support, support for several
remoting technologies is now deprecated and scheduled for removal in
Spring Framework 6.0.

This commit deprecates the following remoting technologies:

* HTTPInvoker
* RMI
* Hessian
* JMS remoting

Other remoting technologies like EJB or JAXWS might be deprecated in the
future depending on industry support.

Closes gh-25379

spring-context/src/main/java/org/springframework/ejb/access/AbstractRemoteSlsbInvokerInterceptor.java

@@ -29,7 +29,6 @@ import org.aopalliance.intercept.MethodInvocation;
 import org.springframework.lang.Nullable;
 import org.springframework.remoting.RemoteConnectFailureException;
 import org.springframework.remoting.RemoteLookupFailureException;
-import org.springframework.remoting.rmi.RmiClientInterceptorUtils;
 
 /**
  * Base class for interceptors proxying remote Stateless Session Beans.
@@ -121,8 +120,9 @@ public abstract class AbstractRemoteSlsbInvokerInterceptor extends AbstractSlsbI
 	 * @return whether the exception should be treated as connect failure
 	 * @see org.springframework.remoting.rmi.RmiClientInterceptorUtils#isConnectFailure
 	 */
+	@SuppressWarnings("deprecation")
 	protected boolean isConnectFailure(RemoteException ex) {
-		return RmiClientInterceptorUtils.isConnectFailure(ex);
+		return org.springframework.remoting.rmi.RmiClientInterceptorUtils.isConnectFailure(ex);
 	}
 
 	@Nullable

spring-context/src/main/java/org/springframework/ejb/access/SimpleRemoteSlsbInvokerInterceptor.java

@@ -28,7 +28,6 @@ import org.aopalliance.intercept.MethodInvocation;
 import org.springframework.beans.factory.DisposableBean;
 import org.springframework.lang.Nullable;
 import org.springframework.remoting.RemoteLookupFailureException;
-import org.springframework.remoting.rmi.RmiClientInterceptorUtils;
 
 /**
  * Basic invoker for a remote Stateless Session Bean.
@@ -95,11 +94,12 @@ public class SimpleRemoteSlsbInvokerInterceptor extends AbstractRemoteSlsbInvoke
 	 */
 	@Override
 	@Nullable
+	@SuppressWarnings("deprecation")
 	protected Object doInvoke(MethodInvocation invocation) throws Throwable {
 		Object ejb = null;
 		try {
 			ejb = getSessionBeanInstance();
-			return RmiClientInterceptorUtils.invokeRemoteMethod(invocation, ejb);
+			return org.springframework.remoting.rmi.RmiClientInterceptorUtils.invokeRemoteMethod(invocation, ejb);
 		}
 		catch (NamingException ex) {
 			throw new RemoteLookupFailureException("Failed to locate remote EJB [" + getJndiName() + "]", ex);
@@ -108,12 +108,12 @@ public class SimpleRemoteSlsbInvokerInterceptor extends AbstractRemoteSlsbInvoke
 			Throwable targetEx = ex.getTargetException();
 			if (targetEx instanceof RemoteException) {
 				RemoteException rex = (RemoteException) targetEx;
-				throw RmiClientInterceptorUtils.convertRmiAccessException(
+				throw org.springframework.remoting.rmi.RmiClientInterceptorUtils.convertRmiAccessException(
-					invocation.getMethod(), rex, isConnectFailure(rex), getJndiName());
+						invocation.getMethod(), rex, isConnectFailure(rex), getJndiName());
 			}
 			else if (targetEx instanceof CreateException) {
-				throw RmiClientInterceptorUtils.convertRmiAccessException(
+				throw org.springframework.remoting.rmi.RmiClientInterceptorUtils.convertRmiAccessException(
-					invocation.getMethod(), targetEx, "Could not create remote EJB [" + getJndiName() + "]");
+						invocation.getMethod(), targetEx, "Could not create remote EJB [" + getJndiName() + "]");
 			}
 			throw targetEx;
 		}

spring-context/src/main/java/org/springframework/remoting/rmi/CodebaseAwareObjectInputStream.java

@@ -50,7 +50,9 @@ import org.springframework.lang.Nullable;
  * @see java.rmi.server.RMIClassLoader
  * @see RemoteInvocationSerializingExporter#createObjectInputStream
  * @see org.springframework.remoting.httpinvoker.HttpInvokerClientInterceptor#setCodebaseUrl
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class CodebaseAwareObjectInputStream extends ConfigurableObjectInputStream {
 
 	private final String codebaseUrl;

spring-context/src/main/java/org/springframework/remoting/rmi/JndiRmiClientInterceptor.java

@@ -72,7 +72,9 @@ import org.springframework.util.Assert;
  * @see org.springframework.remoting.RemoteAccessException
  * @see java.rmi.RemoteException
  * @see java.rmi.Remote
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class JndiRmiClientInterceptor extends JndiObjectLocator implements MethodInterceptor, InitializingBean {
 
 	private Class<?> serviceInterface;

spring-context/src/main/java/org/springframework/remoting/rmi/JndiRmiProxyFactoryBean.java

@@ -61,7 +61,9 @@ import org.springframework.util.ClassUtils;
  * @see java.rmi.RemoteException
  * @see java.rmi.Remote
  * @see javax.rmi.PortableRemoteObject#narrow
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class JndiRmiProxyFactoryBean extends JndiRmiClientInterceptor
 		implements FactoryBean<Object>, BeanClassLoaderAware {
 

spring-context/src/main/java/org/springframework/remoting/rmi/JndiRmiServiceExporter.java

@@ -67,7 +67,9 @@ import org.springframework.util.ReflectionUtils;
  * @see JndiRmiClientInterceptor
  * @see JndiRmiProxyFactoryBean
  * @see javax.rmi.PortableRemoteObject#exportObject
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class JndiRmiServiceExporter extends RmiBasedExporter implements InitializingBean, DisposableBean {
 
 	@Nullable

spring-context/src/main/java/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java

@@ -45,7 +45,9 @@ import org.springframework.util.ClassUtils;
  * @see java.io.ObjectOutputStream
  * @see #doReadRemoteInvocation
  * @see #doWriteRemoteInvocationResult
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public abstract class RemoteInvocationSerializingExporter extends RemoteInvocationBasedExporter
 		implements InitializingBean {
 

spring-context/src/main/java/org/springframework/remoting/rmi/RmiBasedExporter.java

@@ -36,7 +36,9 @@ import org.springframework.remoting.support.RemoteInvocationBasedExporter;
  * @since 1.2.5
  * @see RmiServiceExporter
  * @see JndiRmiServiceExporter
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public abstract class RmiBasedExporter extends RemoteInvocationBasedExporter {
 
 	/**

spring-context/src/main/java/org/springframework/remoting/rmi/RmiClientInterceptor.java

@@ -67,7 +67,9 @@ import org.springframework.remoting.support.RemoteInvocationUtils;
  * @see org.springframework.remoting.RemoteAccessException
  * @see java.rmi.RemoteException
  * @see java.rmi.Remote
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class RmiClientInterceptor extends RemoteInvocationBasedAccessor
 		implements MethodInterceptor {
 

spring-context/src/main/java/org/springframework/remoting/rmi/RmiClientInterceptorUtils.java

@@ -44,7 +44,9 @@ import org.springframework.util.ReflectionUtils;
  *
  * @author Juergen Hoeller
  * @since 1.1
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public abstract class RmiClientInterceptorUtils {
 
 	private static final Log logger = LogFactory.getLog(RmiClientInterceptorUtils.class);

spring-context/src/main/java/org/springframework/remoting/rmi/RmiInvocationHandler.java

@@ -32,7 +32,9 @@ import org.springframework.remoting.support.RemoteInvocation;
  *
  * @author Juergen Hoeller
  * @since 14.05.2003
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public interface RmiInvocationHandler extends Remote {
 
 	/**

spring-context/src/main/java/org/springframework/remoting/rmi/RmiInvocationWrapper.java

@@ -34,6 +34,7 @@ import org.springframework.util.Assert;
  * @since 14.05.2003
  * @see RmiServiceExporter
  */
+@Deprecated
 class RmiInvocationWrapper implements RmiInvocationHandler {
 
 	private final Object wrappedObject;

spring-context/src/main/java/org/springframework/remoting/rmi/RmiProxyFactoryBean.java

@@ -57,7 +57,9 @@ import org.springframework.util.Assert;
  * @see org.springframework.remoting.RemoteAccessException
  * @see org.springframework.remoting.caucho.HessianProxyFactoryBean
  * @see org.springframework.remoting.httpinvoker.HttpInvokerProxyFactoryBean
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class RmiProxyFactoryBean extends RmiClientInterceptor implements FactoryBean<Object>, BeanClassLoaderAware {
 
 	private Object serviceProxy;

spring-context/src/main/java/org/springframework/remoting/rmi/RmiRegistryFactoryBean.java

@@ -60,7 +60,9 @@ import org.springframework.lang.Nullable;
  * @see org.springframework.jmx.support.ConnectorServerFactoryBean
  * @see java.rmi.registry.Registry
  * @see java.rmi.registry.LocateRegistry
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class RmiRegistryFactoryBean implements FactoryBean<Registry>, InitializingBean, DisposableBean {
 
 	protected final Log logger = LogFactory.getLog(getClass());

spring-context/src/main/java/org/springframework/remoting/rmi/RmiServiceExporter.java

@@ -65,7 +65,9 @@ import org.springframework.lang.Nullable;
  * @see java.rmi.RemoteException
  * @see org.springframework.remoting.caucho.HessianServiceExporter
  * @see org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class RmiServiceExporter extends RmiBasedExporter implements InitializingBean, DisposableBean {
 
 	private String serviceName;

spring-jms/src/main/java/org/springframework/jms/remoting/JmsInvokerClientInterceptor.java

@@ -71,7 +71,9 @@ import org.springframework.util.Assert;
  * @see #setQueueName
  * @see org.springframework.jms.remoting.JmsInvokerServiceExporter
  * @see org.springframework.jms.remoting.JmsInvokerProxyFactoryBean
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class JmsInvokerClientInterceptor implements MethodInterceptor, InitializingBean {
 
 	@Nullable

spring-jms/src/main/java/org/springframework/jms/remoting/JmsInvokerProxyFactoryBean.java

@@ -41,7 +41,9 @@ import org.springframework.util.ClassUtils;
  * @see #setServiceInterface
  * @see org.springframework.jms.remoting.JmsInvokerClientInterceptor
  * @see org.springframework.jms.remoting.JmsInvokerServiceExporter
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class JmsInvokerProxyFactoryBean extends JmsInvokerClientInterceptor
 		implements FactoryBean<Object>, BeanClassLoaderAware {
 

spring-jms/src/main/java/org/springframework/jms/remoting/JmsInvokerServiceExporter.java

@@ -51,7 +51,9 @@ import org.springframework.remoting.support.RemoteInvocationResult;
  * @since 2.0
  * @see JmsInvokerClientInterceptor
  * @see JmsInvokerProxyFactoryBean
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class JmsInvokerServiceExporter extends RemoteInvocationBasedExporter
 		implements SessionAwareMessageListener<Message>, InitializingBean {
 

spring-web/src/main/java/org/springframework/remoting/caucho/HessianClientInterceptor.java

@@ -63,7 +63,9 @@ import org.springframework.util.Assert;
  * @see HessianProxyFactoryBean
  * @see com.caucho.hessian.client.HessianProxyFactory
  * @see com.caucho.hessian.server.HessianServlet
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class HessianClientInterceptor extends UrlBasedRemoteAccessor implements MethodInterceptor {
 
 	private HessianProxyFactory proxyFactory = new HessianProxyFactory();

spring-web/src/main/java/org/springframework/remoting/caucho/HessianExporter.java

@@ -53,7 +53,9 @@ import org.springframework.util.CommonsLogWriter;
  * @since 2.5.1
  * @see #invoke(java.io.InputStream, java.io.OutputStream)
  * @see HessianServiceExporter
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class HessianExporter extends RemoteExporter implements InitializingBean {
 
 	/**

spring-web/src/main/java/org/springframework/remoting/caucho/HessianProxyFactoryBean.java

@@ -40,7 +40,9 @@ import org.springframework.lang.Nullable;
  * @see HessianServiceExporter
  * @see org.springframework.remoting.httpinvoker.HttpInvokerProxyFactoryBean
  * @see org.springframework.remoting.rmi.RmiProxyFactoryBean
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class HessianProxyFactoryBean extends HessianClientInterceptor implements FactoryBean<Object> {
 
 	@Nullable

spring-web/src/main/java/org/springframework/remoting/caucho/HessianServiceExporter.java

@@ -44,7 +44,9 @@ import org.springframework.web.util.NestedServletException;
  * @see HessianProxyFactoryBean
  * @see org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter
  * @see org.springframework.remoting.rmi.RmiServiceExporter
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class HessianServiceExporter extends HessianExporter implements HttpRequestHandler {
 
 	/**

spring-web/src/main/java/org/springframework/remoting/httpinvoker/AbstractHttpInvokerRequestExecutor.java

@@ -29,7 +29,6 @@ import org.apache.commons.logging.LogFactory;
 
 import org.springframework.beans.factory.BeanClassLoaderAware;
 import org.springframework.lang.Nullable;
-import org.springframework.remoting.rmi.CodebaseAwareObjectInputStream;
 import org.springframework.remoting.support.RemoteInvocation;
 import org.springframework.remoting.support.RemoteInvocationResult;
 import org.springframework.util.Assert;
@@ -44,7 +43,9 @@ import org.springframework.util.ClassUtils;
  * @author Juergen Hoeller
  * @since 1.1
  * @see #doExecuteRequest
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public abstract class AbstractHttpInvokerRequestExecutor implements HttpInvokerRequestExecutor, BeanClassLoaderAware {
 
 	/**
@@ -264,7 +265,7 @@ public abstract class AbstractHttpInvokerRequestExecutor implements HttpInvokerR
 	 * @see org.springframework.remoting.rmi.CodebaseAwareObjectInputStream
 	 */
 	protected ObjectInputStream createObjectInputStream(InputStream is, @Nullable String codebaseUrl) throws IOException {
-		return new CodebaseAwareObjectInputStream(is, getBeanClassLoader(), codebaseUrl);
+		return new org.springframework.remoting.rmi.CodebaseAwareObjectInputStream(is, getBeanClassLoader(), codebaseUrl);
 	}
 
 	/**

spring-web/src/main/java/org/springframework/remoting/httpinvoker/HttpComponentsHttpInvokerRequestExecutor.java

@@ -60,7 +60,9 @@ import org.springframework.util.Assert;
  * @author Stephane Nicoll
  * @since 3.1
  * @see org.springframework.remoting.httpinvoker.SimpleHttpInvokerRequestExecutor
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class HttpComponentsHttpInvokerRequestExecutor extends AbstractHttpInvokerRequestExecutor {
 
 	private static final int DEFAULT_MAX_TOTAL_CONNECTIONS = 100;

spring-web/src/main/java/org/springframework/remoting/httpinvoker/HttpInvokerClientConfiguration.java

@@ -25,7 +25,9 @@ import org.springframework.lang.Nullable;
  * @since 1.1
  * @see HttpInvokerRequestExecutor
  * @see HttpInvokerClientInterceptor
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public interface HttpInvokerClientConfiguration {
 
 	/**

spring-web/src/main/java/org/springframework/remoting/httpinvoker/HttpInvokerClientInterceptor.java

@@ -69,7 +69,9 @@ import org.springframework.remoting.support.RemoteInvocationResult;
  * @see HttpInvokerServiceExporter
  * @see HttpInvokerProxyFactoryBean
  * @see java.rmi.server.RMIClassLoader
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class HttpInvokerClientInterceptor extends RemoteInvocationBasedAccessor
 		implements MethodInterceptor, HttpInvokerClientConfiguration {
 

spring-web/src/main/java/org/springframework/remoting/httpinvoker/HttpInvokerProxyFactoryBean.java

@@ -53,7 +53,9 @@ import org.springframework.util.Assert;
  * @see HttpInvokerServiceExporter
  * @see org.springframework.remoting.rmi.RmiProxyFactoryBean
  * @see org.springframework.remoting.caucho.HessianProxyFactoryBean
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class HttpInvokerProxyFactoryBean extends HttpInvokerClientInterceptor implements FactoryBean<Object> {
 
 	@Nullable

spring-web/src/main/java/org/springframework/remoting/httpinvoker/HttpInvokerRequestExecutor.java

@@ -40,7 +40,9 @@ import org.springframework.remoting.support.RemoteInvocationResult;
  * @author Juergen Hoeller
  * @since 1.1
  * @see HttpInvokerClientInterceptor#setHttpInvokerRequestExecutor
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 @FunctionalInterface
 public interface HttpInvokerRequestExecutor {
 

spring-web/src/main/java/org/springframework/remoting/httpinvoker/HttpInvokerServiceExporter.java

@@ -27,7 +27,6 @@ import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.springframework.remoting.rmi.RemoteInvocationSerializingExporter;
 import org.springframework.remoting.support.RemoteInvocation;
 import org.springframework.remoting.support.RemoteInvocationResult;
 import org.springframework.web.HttpRequestHandler;
@@ -58,8 +57,10 @@ import org.springframework.web.util.NestedServletException;
  * @see HttpInvokerProxyFactoryBean
  * @see org.springframework.remoting.rmi.RmiServiceExporter
  * @see org.springframework.remoting.caucho.HessianServiceExporter
+ * @deprecated as of 5.3.0 with no replacement.
  */
-public class HttpInvokerServiceExporter extends RemoteInvocationSerializingExporter implements HttpRequestHandler {
+@Deprecated
+public class HttpInvokerServiceExporter extends org.springframework.remoting.rmi.RemoteInvocationSerializingExporter implements HttpRequestHandler {
 
 	/**
 	 * Reads a remote invocation from the request, executes it,
@@ -167,7 +168,7 @@ public class HttpInvokerServiceExporter extends RemoteInvocationSerializingExpor
 			throws IOException {
 
 		try (ObjectOutputStream oos =
-				createObjectOutputStream(new FlushGuardedOutputStream(decorateOutputStream(request, response, os)))) {
+					createObjectOutputStream(new FlushGuardedOutputStream(decorateOutputStream(request, response, os)))) {
 			doWriteRemoteInvocationResult(result, oos);
 		}
 	}

spring-web/src/main/java/org/springframework/remoting/httpinvoker/SimpleHttpInvokerRequestExecutor.java

@@ -41,7 +41,9 @@ import org.springframework.remoting.support.RemoteInvocationResult;
  * @author Juergen Hoeller
  * @since 1.1
  * @see java.net.HttpURLConnection
+ * @deprecated as of 5.3.0 with no replacement.
  */
+@Deprecated
 public class SimpleHttpInvokerRequestExecutor extends AbstractHttpInvokerRequestExecutor {
 
 	private int connectTimeout = -1;

spring-web/src/main/java/org/springframework/remoting/httpinvoker/SimpleHttpInvokerServiceExporter.java

@@ -25,7 +25,6 @@ import java.io.OutputStream;
 import com.sun.net.httpserver.HttpExchange;
 import com.sun.net.httpserver.HttpHandler;
 
-import org.springframework.remoting.rmi.RemoteInvocationSerializingExporter;
 import org.springframework.remoting.support.RemoteInvocation;
 import org.springframework.remoting.support.RemoteInvocationResult;
 
@@ -58,7 +57,7 @@ import org.springframework.remoting.support.RemoteInvocationResult;
  */
 @Deprecated
 @org.springframework.lang.UsesSunHttpServer
-public class SimpleHttpInvokerServiceExporter extends RemoteInvocationSerializingExporter implements HttpHandler {
+public class SimpleHttpInvokerServiceExporter extends org.springframework.remoting.rmi.RemoteInvocationSerializingExporter implements HttpHandler {
 
 	/**
 	 * Reads a remote invocation from the request, executes it,