Never use user input for web metrics

[n0tl3ss]

• Use service ID instead of host to identify clients
• Fallback to a fixed unmatched URI when template is not found

Fixes #458 and Fixes #397

[github-actions]

❌ Java CI failed: https://ge.micronaut.io/s/n2l5mnrhir4xk

[github-actions]

❌ GraalVM CE CI 17 latest failed: https://ge.micronaut.io/s/er5uecux4i7ak

[github-actions]

❌ Java CI failed: https://ge.micronaut.io/s/6wuclqiwq4frc

[github-actions]

❌ GraalVM CE CI 17 latest failed: https://ge.micronaut.io/s/bkjw2awzxuk5i

[github-actions]

❌ Java CI failed: https://ge.micronaut.io/s/ki4cju5fixuzo

[github-actions]

❌ Java CI failed: https://ge.micronaut.io/s/dnkfqulme3ebs

[github-actions]

❌ GraalVM CE CI 17 latest failed: https://ge.micronaut.io/s/gnjxg7hyu4myg

[github-actions]

❌ GraalVM CE CI 17 latest failed: https://ge.micronaut.io/s/wkvzvue4cytga

[github-actions]

❌ Java CI failed: https://ge.micronaut.io/s/ty7kb6md7swmi

[sonarqubecloud]

SonarCloud Quality Gate failed.   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
3 Code Smells

96.0% Coverage
0.0% Duplication

[frank-mueller-at-kiwigrid-com]

I'm new to Github, so please apologize if this is not the correct way to re-open a bug.
Please advise if I should do it in a different way.

After upgrading my Micronaut project to Micronaut Micrometer 5.8.0 the built-in metrics "http_client_requests_seconds_count" & "http_client_requests_seconds_sum" metrics seem to be broken.

Environment

• Micronaut BOM
  io.micronaut.platform:micronaut-platform:4.6.2
  which resolves to
  io.micronaut.micrometer:micronaut-micrometer-registry-prometheus:5.8.0
  io.micrometer:micrometer-core:1.13.3
  io.prometheus:simpleclient:0.16.0

• Micronaut app with 2 HTTP clients configured
  Client A neither sets "micronaut.http.route.template" nor "micronaut.http.serviceId" to the request
  Client B sets "micronaut.http.route.template" and "micronaut.http.serviceId" to the request

• Micronaut app configured to write web metrics using Prometheus

Steps to reproduce

• run your Micronaut App
• initiate an action that let Client A send a request and thus
• initiate an action that let Client B send a request
• check the "http_client_requests_seconds_count" & "http_client_requests_seconds_sum" metrics at the "/prometheus" endpoint of your Micronaut App

Expected
You find metrics produced by both client.

Actual
You find metrics produced by Client A only. Or more general, you find metrics of those client that writes as the first to the metric. The same would happen if Client B goes first.

Assumption
With this bugfix, ClientRequestMetricRegistryFilter & WebMetricsPublisher only writes the "uri" and/or "serviceId" tag if the corresponding request attribute was set by the client.
In the given example, this behavior causes two write operations happen to the same metric with a different set of tags.
However the Prometheus client does not like that.
See micrometer-metrics/micrometer#877 and prometheus/client_java#696

As I'm just a user of the built-in "http_client_requests_seconds_count" & "http_client_requests_seconds_sum" metrics I have no chance to change that behavior.

Suggested fix
As there seems to be different opinions about whether this is a problem in Prometheus client or in Micrometer Prometheus integration and since it unclear when the actual problem gets fixed, I suggest to fix it in Micrometer core:

Let ClientRequestMetricRegistryFilter & WebMetricsPublisher always write the "uri" and "serviceId" tag. If "micronaut.http.route.template" or "micronaut.http.serviceId" are missing at the request, use an artifical constants as tag value.

[sdelamo]

@frank-mueller-at-kiwigrid-com create a separate issue if you think it is necessary