... but I'm finding hard to believe that a class that is part of the java core distribution still has issues after several releases of the JDK.
In defence of Sun, they are caught between a rock and a hard place:
If they fix these problems they will undoubtedly break tens of thousands of legacy applications that depend on the current APIs and their less-than-ideal behaviour. If they did that, the fallout from their paying customer base would be massive. And more enterprises would be stuck using ancient JDK releases.
If they don't fix the problem, they get endless flak from purists who think that every problem should be fixed, and damn compatibility.
At least people who need a HTTP client API have a better alternative ... should they want to use it.
That's the reason why @deprecated got invented.
Theoretically, yes ...
However, in practice, deprecation is used by Oracle as a strong signal to programmers (and more importantly, managers) that they need to change their code.
That is not warranted here. Lets look at the concrete issues:
"HttpURLConnection
cannot handle cookies" is not a reason to deprecate it. People who have already built applications against HttpURLConnection
will have already dealt with this issue. For them, changing to a different HTTP client class unnecessary work.
"HttpURLConnection
doesn't support keep-alives" is not a reason to deprecate either. Most applications don't need keep-alives.
And so on.
Deprecation is a blunt instrument, and the Sun / Oracle philosophy is that it should only be used in cases where an API is difficult to use safely; i.e. when there is a strong business case for developers spending time in reworking code, etcetera.
But don't just take my word for it. Look at the cases where Sun / Oracle has deprecated methods and classes. There is a clear pattern, even if there are historical exceptions to it.