You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@zeppelin.apache.org by pd...@apache.org on 2020/10/14 07:33:00 UTC

[zeppelin] branch master updated: [ZEPPELIN-5090] Migrate to org.apache.httpcomponents:httpclient

This is an automated email from the ASF dual-hosted git repository.

pdallig pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/zeppelin.git


The following commit(s) were added to refs/heads/master by this push:
     new 3ada8af  [ZEPPELIN-5090] Migrate to org.apache.httpcomponents:httpclient
3ada8af is described below

commit 3ada8af5be77f8658d011c0df0f5867c59896d84
Author: Philipp Dallig <ph...@gmail.com>
AuthorDate: Mon Oct 5 14:26:00 2020 +0200

    [ZEPPELIN-5090] Migrate to org.apache.httpcomponents:httpclient
    
    ### What is this PR for?
    This PR includes:
     - Migration from commons-httpclient:commons-httpclient to org.apache.httpcomponents:httpclient
     - Drop some unneeded interpreter dependencies
    
    ### What type of PR is it?
     - Improvement
    
    ### Todos
    * [ ] - Task
    
    ### What is the Jira issue?
    * https://issues.apache.org/jira/browse/ZEPPELIN-5090
    
    ### How should this be tested?
    * Travis-CI: https://travis-ci.org/github/Reamer/zeppelin/builds/734928234
    
    ### Questions:
    * Does the licenses files need update? Yes (done)
    * Is there breaking changes for older versions? No
    * Does this needs documentation? No
    
    Author: Philipp Dallig <ph...@gmail.com>
    
    Closes #3938 from Reamer/http_components and squashes the following commits:
    
    7829bc7d8 [Philipp Dallig] Update commons-httpclient to org.apache.httpcomponents:httpclient
    86684854c [Philipp Dallig] Remove some unused libraries in Zeppelin Interpreter
---
 zeppelin-distribution/src/bin_license/LICENSE      |   1 -
 zeppelin-interpreter/pom.xml                       |  34 ---
 zeppelin-server/pom.xml                            |   6 +-
 .../apache/zeppelin/realm/ZeppelinHubRealm.java    |  43 ++--
 .../apache/zeppelin/cluster/ClusterEventTest.java  |  75 +++---
 .../zeppelin/cluster/ZeppelinServerMock.java       | 229 ++-----------------
 .../configuration/RequestHeaderSizeTest.java       |  30 +--
 .../org/apache/zeppelin/recovery/RecoveryTest.java |  48 ++--
 .../apache/zeppelin/rest/AbstractTestRestApi.java  | 251 +++++++++++----------
 .../zeppelin/rest/ConfigurationsRestApiTest.java   |  14 +-
 .../apache/zeppelin/rest/HeliumRestApiTest.java    |  91 ++++----
 .../zeppelin/rest/InterpreterRestApiTest.java      | 119 +++++-----
 .../org/apache/zeppelin/rest/KnoxRestApiTest.java  |  22 +-
 .../zeppelin/rest/NotebookRepoRestApiTest.java     |  39 ++--
 .../apache/zeppelin/rest/NotebookRestApiTest.java  | 148 ++++++------
 .../zeppelin/rest/NotebookSecurityRestApiTest.java |  85 ++++---
 .../apache/zeppelin/rest/SecurityRestApiTest.java  |  31 ++-
 .../apache/zeppelin/rest/ZeppelinRestApiTest.java  | 230 +++++++++----------
 .../apache/zeppelin/security/DirAccessTest.java    |  29 ++-
 zeppelin-zengine/pom.xml                           |   6 +
 .../repo/zeppelinhub/security/Authentication.java  |  79 ++++---
 21 files changed, 716 insertions(+), 894 deletions(-)

diff --git a/zeppelin-distribution/src/bin_license/LICENSE b/zeppelin-distribution/src/bin_license/LICENSE
index 5a448ac..cbfd20e 100644
--- a/zeppelin-distribution/src/bin_license/LICENSE
+++ b/zeppelin-distribution/src/bin_license/LICENSE
@@ -215,7 +215,6 @@ The following components are provided under Apache License.
     (Apache 2.0) Maven Wagon HTTP Lightweight 1.0 (org.apache.maven.wagon:wagon-http-lightweight:2.7 - https://mvnrepository.com/artifact/org.apache.maven.wagon/wagon-http-lightweight/2.7)
     (Apache 2.0) Maven Wagon HTTP 1.0 (org.apache.maven.wagon:wagon-http:2.7 - https://mvnrepository.com/artifact/org.apache.maven.wagon/wagon-http/2.7)
     (Apache 2.0) Maven Wagon HTTP Shared 1.0 (org.apache.maven.wagon:wagon-http-shared:2.7 - https://mvnrepository.com/artifact/org.apache.maven.wagon/wagon-http-shared/2.7)
-    (Apache 2.0) Commons HTTP Client 3.1 (commons-httpclient:commons-httpclient:3.1 - https://mvnrepository.com/artifact/commons-httpclient/commons-httpclient/3.1)
     (Apache 2.0) Scalatest 2.2.4 (org.scalatest:scalatest_2.10:2.2.4 - https://github.com/scalatest/scalatest)
     (Apache 2.0) frontend-maven-plugin 1.3 (com.github.eirslett:frontend-maven-plugin:1.3 - https://github.com/eirslett/frontend-maven-plugin/blob/frontend-plugins-1.3/LICENSE
     (Apache 2.0) frontend-plugin-core 1.3 (com.github.eirslett:frontend-plugin-core) - https://github.com/eirslett/frontend-maven-plugin/blob/frontend-plugins-1.3/LICENSE
diff --git a/zeppelin-interpreter/pom.xml b/zeppelin-interpreter/pom.xml
index 736d8a8..93925ba 100644
--- a/zeppelin-interpreter/pom.xml
+++ b/zeppelin-interpreter/pom.xml
@@ -44,7 +44,6 @@
     <wagon.version>2.7</wagon.version>
     <jline.version>2.14.3</jline.version>
     <atomix.version>3.0.0-rc4</atomix.version>
-    <commons-math3.version>3.1.1</commons-math3.version>
 
     <!--plugin versions-->
     <plugin.shade.version>2.3</plugin.shade.version>
@@ -64,10 +63,6 @@
       <exclusions>
         <exclusion>
           <groupId>org.apache.commons</groupId>
-          <artifactId>commons-math3</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.commons</groupId>
           <artifactId>commons-lang3</artifactId>
         </exclusion>
       </exclusions>
@@ -87,12 +82,6 @@
 
     <dependency>
       <groupId>org.apache.commons</groupId>
-      <artifactId>commons-math3</artifactId>
-      <version>${commons-math3.version}</version>
-    </dependency>
-
-    <dependency>
-      <groupId>org.apache.commons</groupId>
       <artifactId>commons-lang3</artifactId>
     </dependency>
 
@@ -114,11 +103,6 @@
     </dependency>
 
     <dependency>
-      <groupId>org.danilopianini</groupId>
-      <artifactId>gson-extras</artifactId>
-    </dependency>
-
-    <dependency>
       <groupId>commons-configuration</groupId>
       <artifactId>commons-configuration</artifactId>
       <exclusions>
@@ -191,11 +175,6 @@
     </dependency>
 
     <dependency>
-      <groupId>org.bouncycastle</groupId>
-      <artifactId>bcpkix-jdk15on</artifactId>
-    </dependency>
-
-    <dependency>
       <groupId>org.apache.maven</groupId>
       <artifactId>maven-aether-provider</artifactId>
       <version>${maven.aeither.provider.version}</version>
@@ -242,19 +221,6 @@
     </dependency>
 
     <dependency>
-      <groupId>commons-httpclient</groupId>
-      <artifactId>commons-httpclient</artifactId>
-      <version>3.1</version>
-      <exclusions>
-        <!-- using jcl-over-slf4j instead -->
-        <exclusion>
-          <groupId>commons-logging</groupId>
-          <artifactId>commons-logging</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-
-    <dependency>
       <groupId>org.apache.maven.wagon</groupId>
       <artifactId>wagon-provider-api</artifactId>
       <version>${wagon.version}</version>
diff --git a/zeppelin-server/pom.xml b/zeppelin-server/pom.xml
index bb4719a..d6affe0 100644
--- a/zeppelin-server/pom.xml
+++ b/zeppelin-server/pom.xml
@@ -36,7 +36,6 @@
   <properties>
 
     <!--library versions-->
-    <commons.httpclient.version>4.3.6</commons.httpclient.version>
     <jersey.version>2.27</jersey.version>
     <jersey.servlet.version>1.13</jersey.servlet.version>
     <javax.ws.rsapi.version>2.1</javax.ws.rsapi.version>
@@ -94,6 +93,11 @@
     </dependency>
 
     <dependency>
+      <groupId>org.apache.httpcomponents</groupId>
+      <artifactId>httpclient</artifactId>
+    </dependency>
+
+    <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-log4j12</artifactId>
     </dependency>
diff --git a/zeppelin-server/src/main/java/org/apache/zeppelin/realm/ZeppelinHubRealm.java b/zeppelin-server/src/main/java/org/apache/zeppelin/realm/ZeppelinHubRealm.java
index 94d8126..d53b389 100644
--- a/zeppelin-server/src/main/java/org/apache/zeppelin/realm/ZeppelinHubRealm.java
+++ b/zeppelin-server/src/main/java/org/apache/zeppelin/realm/ZeppelinHubRealm.java
@@ -23,13 +23,18 @@ import java.io.IOException;
 import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.nio.charset.StandardCharsets;
 import java.util.HashSet;
 import java.util.concurrent.atomic.AtomicInteger;
-import org.apache.commons.httpclient.HttpClient;
-import org.apache.commons.httpclient.HttpStatus;
-import org.apache.commons.httpclient.methods.PutMethod;
-import org.apache.commons.httpclient.methods.StringRequestEntity;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.http.HttpStatus;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPut;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.util.EntityUtils;
 import org.apache.shiro.authc.AccountException;
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationInfo;
@@ -55,12 +60,10 @@ public class ZeppelinHubRealm extends AuthorizingRealm {
   private static final Logger LOG = LoggerFactory.getLogger(ZeppelinHubRealm.class);
   private static final String DEFAULT_ZEPPELINHUB_URL = "https://www.zeppelinhub.com";
   private static final String USER_LOGIN_API_ENDPOINT = "api/v1/users/login";
-  private static final String JSON_CONTENT_TYPE = "application/json";
-  private static final String UTF_8_ENCODING = "UTF-8";
   private static final String USER_SESSION_HEADER = "X-session";
   private static final AtomicInteger INSTANCE_COUNT = new AtomicInteger();
 
-  private final HttpClient httpClient;
+  private final CloseableHttpClient httpClient;
 
   private String zeppelinhubUrl;
   private String name;
@@ -70,7 +73,7 @@ public class ZeppelinHubRealm extends AuthorizingRealm {
     LOG.debug("Init ZeppelinhubRealm");
     //TODO(anthonyc): think about more setting for this HTTP client.
     //                eg: if user uses proxy etcetc...
-    httpClient = new HttpClient();
+    httpClient = HttpClients.createDefault();
     name = getClass().getName() + "_" + INSTANCE_COUNT.getAndIncrement();
   }
 
@@ -93,6 +96,7 @@ public class ZeppelinHubRealm extends AuthorizingRealm {
     return null;
   }
 
+  @Override
   protected void onInit() {
     super.onInit();
   }
@@ -125,33 +129,29 @@ public class ZeppelinHubRealm extends AuthorizingRealm {
    * @throws AuthenticationException if fail to login.
    */
   protected User authenticateUser(String requestBody) {
-    PutMethod put = new PutMethod(Joiner.on("/").join(zeppelinhubUrl, USER_LOGIN_API_ENDPOINT));
     String responseBody;
     String userSession;
-    try {
-      put.setRequestEntity(new StringRequestEntity(requestBody, JSON_CONTENT_TYPE, UTF_8_ENCODING));
-      int statusCode = httpClient.executeMethod(put);
-      if (statusCode != HttpStatus.SC_OK) {
-        LOG.error("Cannot login user, HTTP status code is {} instead on 200 (OK)", statusCode);
+    HttpPut put = new HttpPut(Joiner.on("/").join(zeppelinhubUrl, USER_LOGIN_API_ENDPOINT));
+    put.setEntity(new StringEntity(requestBody, ContentType.APPLICATION_JSON));
+    try (CloseableHttpResponse response = httpClient.execute(put)){
+      if (HttpStatus.SC_OK != response.getStatusLine().getStatusCode()) {
+        LOG.error("Cannot login user, HTTP status code is {} instead on 200 (OK)", response.getStatusLine().getStatusCode());
         put.releaseConnection();
         throw new AuthenticationException("Couldnt login to ZeppelinHub. "
             + "Login or password incorrect");
       }
-      responseBody = put.getResponseBodyAsString();
-      userSession = put.getResponseHeader(USER_SESSION_HEADER).getValue();
+      responseBody = EntityUtils.toString(response.getEntity(), StandardCharsets.UTF_8);
+      userSession = response.getFirstHeader(USER_SESSION_HEADER).getValue();
       put.releaseConnection();
-
     } catch (IOException e) {
-      LOG.error("Cannot login user", e);
-      throw new AuthenticationException(e.getMessage());
+      throw new AuthenticationException("Cannot login user", e);
     }
 
     User account;
     try {
       account = User.fromJson(responseBody);
     } catch (JsonParseException e) {
-      LOG.error("Cannot fromJson ZeppelinHub response to User instance", e);
-      throw new AuthenticationException("Cannot login to ZeppelinHub");
+      throw new AuthenticationException("Cannot login to ZeppelinHub", e);
     }
 
     onLoginSuccess(account.login, userSession);
@@ -207,6 +207,7 @@ public class ZeppelinHubRealm extends AuthorizingRealm {
     public String email;
     public String name;
 
+    @Override
     public String toJson() {
       return gson.toJson(this);
     }
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/cluster/ClusterEventTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/cluster/ClusterEventTest.java
index 95e1caa..e5350fd 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/cluster/ClusterEventTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/cluster/ClusterEventTest.java
@@ -22,10 +22,8 @@ import com.google.gson.JsonArray;
 import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
 import com.google.gson.reflect.TypeToken;
-import org.apache.commons.httpclient.methods.DeleteMethod;
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.httpclient.methods.PostMethod;
-import org.apache.commons.httpclient.methods.PutMethod;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
 import org.apache.thrift.TException;
 import org.apache.zeppelin.cluster.meta.ClusterMetaType;
 import org.apache.zeppelin.conf.ZeppelinConfiguration;
@@ -39,7 +37,7 @@ import org.apache.zeppelin.notebook.Note;
 import org.apache.zeppelin.notebook.Notebook;
 import org.apache.zeppelin.notebook.Paragraph;
 import org.apache.zeppelin.notebook.scheduler.QuartzSchedulerService;
-import org.apache.zeppelin.notebook.scheduler.SchedulerService;
+import org.apache.zeppelin.rest.AbstractTestRestApi;
 import org.apache.zeppelin.rest.message.NewParagraphRequest;
 import org.apache.zeppelin.service.ConfigurationService;
 import org.apache.zeppelin.service.NotebookService;
@@ -58,6 +56,7 @@ import javax.servlet.http.HttpServletRequest;
 import java.io.IOException;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationTargetException;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -261,7 +260,6 @@ public class ClusterEventTest extends ZeppelinServerMock {
   }
 
   static boolean clusterIsStartup() {
-    boolean foundLeader = false;
     for (ClusterManagerServer clusterServer : clusterServers) {
       if (!clusterServer.raftInitialized()) {
         LOGGER.warn("clusterServer not Initialized!");
@@ -302,9 +300,9 @@ public class ClusterEventTest extends ZeppelinServerMock {
       final String newName = "testName";
       String jsonRequest = "{\"name\": " + newName + "}";
 
-      PutMethod put = httpPut("/notebook/" + noteId + "/rename/", jsonRequest);
-      assertThat("test testRenameNote:", put, isAllowed());
-      put.releaseConnection();
+      CloseableHttpResponse put = AbstractTestRestApi.httpPut("/notebook/" + noteId + "/rename/", jsonRequest);
+      assertThat("test testRenameNote:", put, AbstractTestRestApi.isAllowed());
+      put.close();
 
       assertEquals(note.getName(), newName);
 
@@ -329,22 +327,23 @@ public class ClusterEventTest extends ZeppelinServerMock {
       note1 = TestUtils.getInstance(Notebook.class).createNote("note1", anonymous);
       Thread.sleep(1000);
 
-      PostMethod post = httpPost("/notebook/" + note1.getId(), "");
-      LOG.info("testCloneNote response\n" + post.getResponseBodyAsString());
-      assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      CloseableHttpResponse post = AbstractTestRestApi.httpPost("/notebook/" + note1.getId(), "");
+      LOG.info("testCloneNote response\n" + post.getStatusLine().getReasonPhrase());
+      assertThat(post, AbstractTestRestApi.isAllowed());
+
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
           new TypeToken<Map<String, Object>>() {}.getType());
       clonedNoteId = (String) resp.get("body");
-      post.releaseConnection();
+      post.close();
       Thread.sleep(1000);
 
-      GetMethod get = httpGet("/notebook/" + clonedNoteId);
-      assertThat(get, isAllowed());
-      Map<String, Object> resp2 = gson.fromJson(get.getResponseBodyAsString(),
+      CloseableHttpResponse get = AbstractTestRestApi.httpGet("/notebook/" + clonedNoteId);
+      assertThat(get, AbstractTestRestApi.isAllowed());
+      Map<String, Object> resp2 = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
           new TypeToken<Map<String, Object>>() {}.getType());
       Map<String, Object> resp2Body = (Map<String, Object>) resp2.get("body");
 
-      get.releaseConnection();
+      get.close();
 
       // wait cluster sync event
       Thread.sleep(1000);
@@ -377,10 +376,10 @@ public class ClusterEventTest extends ZeppelinServerMock {
       // insert new paragraph
       NewParagraphRequest newParagraphRequest = new NewParagraphRequest();
 
-      PostMethod post = httpPost("/notebook/" + note.getId() + "/paragraph", newParagraphRequest.toJson());
-      LOG.info("test clear paragraph output response\n" + post.getResponseBodyAsString());
-      assertThat(post, isAllowed());
-      post.releaseConnection();
+      CloseableHttpResponse post = AbstractTestRestApi.httpPost("/notebook/" + note.getId() + "/paragraph", newParagraphRequest.toJson());
+      LOG.info("test clear paragraph output response\n" + EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8));
+      assertThat(post, AbstractTestRestApi.isAllowed());
+      post.close();
 
       // wait cluster sync event
       Thread.sleep(1000);
@@ -478,17 +477,17 @@ public class ClusterEventTest extends ZeppelinServerMock {
         "      \"exclusions\":[]\n" +
         "    }]," +
         "\"option\": { \"remote\": true, \"session\": false }}";
-    PostMethod post = httpPost("/interpreter/setting", reqBody1);
-    String postResponse = post.getResponseBodyAsString();
-    LOG.info("testCreatedInterpreterDependencies create response\n" + post.getResponseBodyAsString());
+    CloseableHttpResponse post = AbstractTestRestApi.httpPost("/interpreter/setting", reqBody1);
+    String postResponse = EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8);
+    LOG.info("testCreatedInterpreterDependencies create response\n" + postResponse);
     InterpreterSetting created = convertResponseToInterpreterSetting(postResponse);
-    MatcherAssert.assertThat("test create method:", post, isAllowed());
-    post.releaseConnection();
+    MatcherAssert.assertThat("test create method:", post, AbstractTestRestApi.isAllowed());
+    post.close();
 
     // 1. Call settings API
-    GetMethod get = httpGet("/interpreter/setting");
-    String rawResponse = get.getResponseBodyAsString();
-    get.releaseConnection();
+    CloseableHttpResponse get = AbstractTestRestApi.httpGet("/interpreter/setting");
+    String rawResponse = EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8);
+    get.close();
 
     // 2. Parsing to List<InterpreterSettings>
     JsonObject responseJson = gson.fromJson(rawResponse, JsonElement.class).getAsJsonObject();
@@ -528,20 +527,20 @@ public class ClusterEventTest extends ZeppelinServerMock {
     jsonObject.addProperty("value", "this is new prop");
     jsonObject.addProperty("type", "textarea");
     jsonRequest.getAsJsonObject("properties").add("propname2", jsonObject);
-    PutMethod put = httpPut("/interpreter/setting/" + created.getId(), jsonRequest.toString());
-    LOG.info("testSettingCRUD update response\n" + put.getResponseBodyAsString());
+    CloseableHttpResponse put = AbstractTestRestApi.httpPut("/interpreter/setting/" + created.getId(), jsonRequest.toString());
+    LOG.info("testSettingCRUD update response\n" + EntityUtils.toString(put.getEntity(), StandardCharsets.UTF_8));
     // then: call update setting API
-    MatcherAssert.assertThat("test update method:", put, isAllowed());
-    put.releaseConnection();
+    MatcherAssert.assertThat("test update method:", put, AbstractTestRestApi.isAllowed());
+    put.close();
     Thread.sleep(1000);
     checkClusterIntpSettingEventListener();
 
     // 3: call delete setting API
-    DeleteMethod delete = httpDelete("/interpreter/setting/" + created.getId());
-    LOG.info("testSettingCRUD delete response\n" + delete.getResponseBodyAsString());
+    CloseableHttpResponse delete = AbstractTestRestApi.httpDelete("/interpreter/setting/" + created.getId());
+    LOG.info("testSettingCRUD delete response\n" + EntityUtils.toString(delete.getEntity(), StandardCharsets.UTF_8));
     // then: call delete setting API
-    MatcherAssert.assertThat("Test delete method:", delete, isAllowed());
-    delete.releaseConnection();
+    MatcherAssert.assertThat("Test delete method:", delete, AbstractTestRestApi.isAllowed());
+    delete.close();
     Thread.sleep(1000);
     checkClusterIntpSettingEventListener();
   }
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/cluster/ZeppelinServerMock.java b/zeppelin-server/src/test/java/org/apache/zeppelin/cluster/ZeppelinServerMock.java
index 58cc138..6ebfadc 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/cluster/ZeppelinServerMock.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/cluster/ZeppelinServerMock.java
@@ -16,22 +16,30 @@
  */
 package org.apache.zeppelin.cluster;
 
-import org.apache.commons.httpclient.Header;
-import org.apache.commons.httpclient.HttpClient;
-import org.apache.commons.httpclient.HttpMethodBase;
-import org.apache.commons.httpclient.cookie.CookiePolicy;
-import org.apache.commons.httpclient.methods.ByteArrayRequestEntity;
-import org.apache.commons.httpclient.methods.DeleteMethod;
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.httpclient.methods.PostMethod;
-import org.apache.commons.httpclient.methods.PutMethod;
-import org.apache.commons.httpclient.methods.RequestEntity;
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.http.Header;
+import org.apache.http.HttpResponse;
+import org.apache.http.HttpStatus;
+import org.apache.http.NameValuePair;
+import org.apache.http.client.config.CookieSpecs;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.entity.UrlEncodedFormEntity;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpDelete;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.client.methods.HttpPut;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.message.BasicNameValuePair;
 import org.apache.zeppelin.conf.ZeppelinConfiguration;
 import org.apache.zeppelin.interpreter.InterpreterSetting;
 import org.apache.zeppelin.notebook.Notebook;
 import org.apache.zeppelin.plugin.PluginManager;
+import org.apache.zeppelin.rest.AbstractTestRestApi;
 import org.apache.zeppelin.server.ZeppelinServer;
 import org.apache.zeppelin.utils.TestUtils;
 import org.hamcrest.Description;
@@ -43,6 +51,8 @@ import org.slf4j.LoggerFactory;
 import java.io.File;
 import java.io.IOException;
 import java.lang.ref.WeakReference;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
@@ -51,9 +61,7 @@ import java.util.regex.Pattern;
 public class ZeppelinServerMock {
   protected static final Logger LOG = LoggerFactory.getLogger(ZeppelinServerMock.class);
 
-  static final String REST_API_URL = "/api";
-  static final String URL = getUrlToTest();
-  protected static final boolean WAS_RUNNING = checkIfServerIsRunning();
+  protected static final boolean WAS_RUNNING = AbstractTestRestApi.checkIfServerIsRunning();
 
   protected static File zeppelinHome;
   protected static File confDir;
@@ -66,7 +74,7 @@ public class ZeppelinServerMock {
     } else {
       url = "http://localhost:8080";
     }
-    url += REST_API_URL;
+    url += AbstractTestRestApi.REST_API_URL;
     if (path != null) {
       url += path;
     }
@@ -74,14 +82,6 @@ public class ZeppelinServerMock {
     return url;
   }
 
-  protected static String getUrlToTest() {
-    String url = "http://localhost:8080" + REST_API_URL;
-    if (System.getProperty("url") != null) {
-      url = System.getProperty("url");
-    }
-    return url;
-  }
-
   static ExecutorService executor;
   protected static final Runnable SERVER = new Runnable() {
     @Override
@@ -139,7 +139,7 @@ public class ZeppelinServerMock {
       boolean started = false;
       while (System.currentTimeMillis() - s < 1000 * 60 * 3) {  // 3 minutes
         Thread.sleep(2000);
-        started = checkIfServerIsRunning();
+        started = AbstractTestRestApi.checkIfServerIsRunning();
         if (started == true) {
           break;
         }
@@ -184,7 +184,7 @@ public class ZeppelinServerMock {
       boolean started = true;
       while (System.currentTimeMillis() - s < 1000 * 60 * 3) {  // 3 minutes
         Thread.sleep(2000);
-        started = checkIfServerIsRunning();
+        started = AbstractTestRestApi.checkIfServerIsRunning();
         if (started == false) {
           break;
         }
@@ -208,186 +208,5 @@ public class ZeppelinServerMock {
     }
   }
 
-  protected static boolean checkIfServerIsRunning() {
-    GetMethod request = null;
-    boolean isRunning;
-    try {
-      request = httpGet("/version");
-      isRunning = request.getStatusCode() == 200;
-    } catch (IOException e) {
-      LOG.error("AbstractTestRestApi.checkIfServerIsRunning() fails .. ZeppelinServer is not " +
-          "running");
-      isRunning = false;
-    } finally {
-      if (request != null) {
-        request.releaseConnection();
-      }
-    }
-    return isRunning;
-  }
-
-  protected static GetMethod httpGet(String path) throws IOException {
-    return httpGet(path, StringUtils.EMPTY, StringUtils.EMPTY);
-  }
-
-  protected static GetMethod httpGet(String path, String user, String pwd) throws IOException {
-    return httpGet(path, user, pwd, StringUtils.EMPTY);
-  }
 
-  protected static GetMethod httpGet(String path, String user, String pwd, String cookies)
-      throws IOException {
-    LOG.info("Connecting to {}", URL + path);
-    HttpClient httpClient = new HttpClient();
-    GetMethod getMethod = new GetMethod(URL + path);
-    getMethod.addRequestHeader("Origin", URL);
-    if (userAndPasswordAreNotBlank(user, pwd)) {
-      getMethod.setRequestHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
-    }
-    if (!StringUtils.isBlank(cookies)) {
-      getMethod.setRequestHeader("Cookie", getMethod.getResponseHeader("Cookie") + ";" + cookies);
-    }
-    httpClient.executeMethod(getMethod);
-    LOG.info("{} - {}", getMethod.getStatusCode(), getMethod.getStatusText());
-    return getMethod;
-  }
-
-  protected static PutMethod httpPut(String path, String body) throws IOException {
-    return httpPut(path, body, StringUtils.EMPTY, StringUtils.EMPTY);
-  }
-
-  protected static PutMethod httpPut(String path, String body, String user, String pwd)
-      throws IOException {
-    LOG.info("Connecting to {}", URL + path);
-    HttpClient httpClient = new HttpClient();
-    PutMethod putMethod = new PutMethod(URL + path);
-    putMethod.addRequestHeader("Origin", URL);
-    RequestEntity entity = new ByteArrayRequestEntity(body.getBytes("UTF-8"));
-    putMethod.setRequestEntity(entity);
-    if (userAndPasswordAreNotBlank(user, pwd)) {
-      putMethod.setRequestHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
-    }
-    httpClient.executeMethod(putMethod);
-    LOG.info("{} - {}", putMethod.getStatusCode(), putMethod.getStatusText());
-    return putMethod;
-  }
-
-  protected static PostMethod httpPost(String path, String body) throws IOException {
-    return httpPost(path, body, StringUtils.EMPTY, StringUtils.EMPTY);
-  }
-
-  protected static DeleteMethod httpDelete(String path) throws IOException {
-    return httpDelete(path, StringUtils.EMPTY, StringUtils.EMPTY);
-  }
-
-  protected static DeleteMethod httpDelete(String path, String user, String pwd)
-      throws IOException {
-    LOG.info("Connecting to {}", URL + path);
-    HttpClient httpClient = new HttpClient();
-    DeleteMethod deleteMethod = new DeleteMethod(URL + path);
-    deleteMethod.addRequestHeader("Origin", URL);
-    if (userAndPasswordAreNotBlank(user, pwd)) {
-      deleteMethod.setRequestHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
-    }
-    httpClient.executeMethod(deleteMethod);
-    LOG.info("{} - {}", deleteMethod.getStatusCode(), deleteMethod.getStatusText());
-    return deleteMethod;
-  }
-
-  protected static PostMethod httpPost(String path, String request, String user, String pwd)
-      throws IOException {
-    LOG.info("Connecting to {}", URL + path);
-    HttpClient httpClient = new HttpClient();
-    PostMethod postMethod = new PostMethod(URL + path);
-    postMethod.setRequestBody(request);
-    postMethod.getParams().setCookiePolicy(CookiePolicy.IGNORE_COOKIES);
-    if (userAndPasswordAreNotBlank(user, pwd)) {
-      postMethod.setRequestHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
-    }
-    httpClient.executeMethod(postMethod);
-    LOG.info("{} - {}", postMethod.getStatusCode(), postMethod.getStatusText());
-    return postMethod;
-  }
-
-  private static String getCookie(String user, String password) throws IOException {
-    HttpClient httpClient = new HttpClient();
-    PostMethod postMethod = new PostMethod(URL + "/login");
-    postMethod.addRequestHeader("Origin", URL);
-    postMethod.setParameter("password", password);
-    postMethod.setParameter("userName", user);
-    httpClient.executeMethod(postMethod);
-    LOG.info("{} - {}", postMethod.getStatusCode(), postMethod.getStatusText());
-    Pattern pattern = Pattern.compile("JSESSIONID=([a-zA-Z0-9-]*)");
-    Header[] setCookieHeaders = postMethod.getResponseHeaders("Set-Cookie");
-    String jsessionId = null;
-    for (Header setCookie : setCookieHeaders) {
-      java.util.regex.Matcher matcher = pattern.matcher(setCookie.toString());
-      if (matcher.find()) {
-        jsessionId = matcher.group(1);
-      }
-    }
-
-    if (jsessionId != null) {
-      return jsessionId;
-    } else {
-      return StringUtils.EMPTY;
-    }
-  }
-
-  protected static boolean userAndPasswordAreNotBlank(String user, String pwd) {
-    if (StringUtils.isBlank(user) && StringUtils.isBlank(pwd)) {
-      return false;
-    }
-    return true;
-  }
-
-  protected Matcher<HttpMethodBase> responsesWith(final int expectedStatusCode) {
-    return new TypeSafeMatcher<HttpMethodBase>() {
-      WeakReference<HttpMethodBase> method;
-
-      @Override
-      public boolean matchesSafely(HttpMethodBase httpMethodBase) {
-        method = (method == null) ? new WeakReference<>(httpMethodBase) : method;
-        return httpMethodBase.getStatusCode() == expectedStatusCode;
-      }
-
-      @Override
-      public void describeTo(Description description) {
-        description.appendText("HTTP response ").appendValue(expectedStatusCode)
-            .appendText(" from ").appendText(method.get().getPath());
-      }
-
-      @Override
-      protected void describeMismatchSafely(HttpMethodBase item, Description description) {
-        description.appendText("got ").appendValue(item.getStatusCode()).appendText(" ")
-            .appendText(item.getStatusText());
-      }
-    };
-  }
-
-  /**
-   * Status code matcher.
-   */
-  protected Matcher<? super HttpMethodBase> isForbidden() {
-    return responsesWith(403);
-  }
-
-  protected Matcher<? super HttpMethodBase> isAllowed() {
-    return responsesWith(200);
-  }
-
-  protected Matcher<? super HttpMethodBase> isCreated() {
-    return responsesWith(201);
-  }
-
-  protected Matcher<? super HttpMethodBase> isBadRequest() {
-    return responsesWith(400);
-  }
-
-  protected Matcher<? super HttpMethodBase> isNotFound() {
-    return responsesWith(404);
-  }
-
-  protected Matcher<? super HttpMethodBase> isNotAllowed() {
-    return responsesWith(405);
-  }
 }
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/configuration/RequestHeaderSizeTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/configuration/RequestHeaderSizeTest.java
index 42018ec..696dbe1 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/configuration/RequestHeaderSizeTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/configuration/RequestHeaderSizeTest.java
@@ -19,10 +19,12 @@ package org.apache.zeppelin.configuration;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.MatcherAssert.assertThat;
 
-import org.apache.commons.httpclient.HttpClient;
-import org.apache.commons.httpclient.methods.GetMethod;
 import org.apache.commons.lang3.RandomStringUtils;
-import org.eclipse.jetty.http.HttpStatus;
+import org.apache.http.HttpStatus;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
@@ -48,18 +50,20 @@ public class RequestHeaderSizeTest extends AbstractTestRestApi {
   @Test
   public void increased_request_header_size_do_not_cause_431_when_request_size_is_over_8K()
       throws Exception {
-    HttpClient httpClient = new HttpClient();
-
-    GetMethod getMethod = new GetMethod(getUrlToTest() + "/version");
+    CloseableHttpClient client = HttpClients.createDefault();
+    HttpGet httpGet = new HttpGet(getUrlToTest() + "/version");
     String headerValue = RandomStringUtils.randomAlphanumeric(REQUEST_HEADER_MAX_SIZE - 2000);
-    getMethod.setRequestHeader("not_too_large_header", headerValue);
-    int httpCode = httpClient.executeMethod(getMethod);
-    assertThat(httpCode, is(HttpStatus.OK_200));
+    httpGet.setHeader("not_too_large_header", headerValue);
+    CloseableHttpResponse response = client.execute(httpGet);
+    assertThat(response.getStatusLine().getStatusCode(), is(HttpStatus.SC_OK));
+    response.close();
 
-    getMethod = new GetMethod(getUrlToTest() + "/version");
+    httpGet = new HttpGet(getUrlToTest() + "/version");
     headerValue = RandomStringUtils.randomAlphanumeric(REQUEST_HEADER_MAX_SIZE + 2000);
-    getMethod.setRequestHeader("too_large_header", headerValue);
-    httpCode = httpClient.executeMethod(getMethod);
-    assertThat(httpCode, is(HttpStatus.REQUEST_HEADER_FIELDS_TOO_LARGE_431));
+    httpGet.setHeader("too_large_header", headerValue);
+    response = client.execute(httpGet);
+    assertThat(response.getStatusLine().getStatusCode(), is(431));
+    response.close();
+    client.close();
   }
 }
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/recovery/RecoveryTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/recovery/RecoveryTest.java
index 435330b..01d2e73 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/recovery/RecoveryTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/recovery/RecoveryTest.java
@@ -19,8 +19,9 @@ package org.apache.zeppelin.recovery;
 import com.google.common.io.Files;
 import com.google.gson.Gson;
 import com.google.gson.reflect.TypeToken;
-import org.apache.commons.httpclient.methods.PostMethod;
 import org.apache.commons.io.FileUtils;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
 import org.apache.zeppelin.conf.ZeppelinConfiguration;
 import org.apache.zeppelin.interpreter.InterpreterSetting;
 import org.apache.zeppelin.interpreter.InterpreterSettingManager;
@@ -40,6 +41,7 @@ import org.junit.Before;
 import org.junit.Test;
 
 import java.io.File;
+import java.nio.charset.StandardCharsets;
 import java.util.Map;
 
 import static org.junit.Assert.assertEquals;
@@ -85,12 +87,12 @@ public class RecoveryTest extends AbstractTestRestApi {
       // run python interpreter and create new variable `user`
       Paragraph p1 = note1.addNewParagraph(AuthenticationInfo.ANONYMOUS);
       p1.setText("%python user='abc'");
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() +"?blocking=true", "");
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() +"?blocking=true", "");
       assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
       assertEquals(Job.Status.FINISHED, p1.getStatus());
       TestUtils.getInstance(Notebook.class).saveNote(note1, anonymous);
 
@@ -105,8 +107,8 @@ public class RecoveryTest extends AbstractTestRestApi {
       p1 = note1.getParagraph(p1.getId());
       p1.setText("%python print(user)");
       post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
       assertEquals(Job.Status.FINISHED, p1.getStatus());
       assertEquals("abc\n", p1.getReturn().message().get(0).getData());
     } catch (Exception e) {
@@ -129,12 +131,12 @@ public class RecoveryTest extends AbstractTestRestApi {
       // run python interpreter and create new variable `user`
       Paragraph p1 = note1.addNewParagraph(AuthenticationInfo.ANONYMOUS);
       p1.setText("%python user='abc'");
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
       assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
       assertEquals(Job.Status.FINISHED, p1.getStatus());
       TestUtils.getInstance(Notebook.class).saveNote(note1, AuthenticationInfo.ANONYMOUS);
       // restart the python interpreter
@@ -154,8 +156,8 @@ public class RecoveryTest extends AbstractTestRestApi {
       p1 = note1.getParagraph(p1.getId());
       p1.setText("%python print(user)");
       post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
       assertEquals(Job.Status.ERROR, p1.getStatus());
     } catch (Exception e) {
       LOG.error(e.toString(), e);
@@ -177,12 +179,12 @@ public class RecoveryTest extends AbstractTestRestApi {
       // run python interpreter and create new variable `user`
       Paragraph p1 = note1.addNewParagraph(AuthenticationInfo.ANONYMOUS);
       p1.setText("%python user='abc'");
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
       assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
       assertEquals(Job.Status.FINISHED, p1.getStatus());
       TestUtils.getInstance(Notebook.class).saveNote(note1, AuthenticationInfo.ANONYMOUS);
 
@@ -199,8 +201,8 @@ public class RecoveryTest extends AbstractTestRestApi {
       p1 = note1.getParagraph(p1.getId());
       p1.setText("%python print(user)");
       post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
       assertEquals(Job.Status.ERROR, p1.getStatus());
     } catch (Exception e ) {
       LOG.error(e.toString(), e);
@@ -222,9 +224,9 @@ public class RecoveryTest extends AbstractTestRestApi {
       // run sh paragraph async, print 'hello' after 10 seconds
       Paragraph p1 = note1.addNewParagraph(AuthenticationInfo.ANONYMOUS);
       p1.setText("%sh sleep 10\necho 'hello'");
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() + "/" + p1.getId(), "");
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() + "/" + p1.getId(), "");
       assertThat(post, isAllowed());
-      post.releaseConnection();
+      post.close();
       long start = System.currentTimeMillis();
       // wait until paragraph is RUNNING
       while((System.currentTimeMillis() - start) < 10 * 1000) {
@@ -281,9 +283,9 @@ public class RecoveryTest extends AbstractTestRestApi {
               "for i in range(1, 10):\n" +
               "    time.sleep(1)\n" +
               "    print(i)");
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() + "/" + p1.getId(), "");
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() + "/" + p1.getId(), "");
       assertThat(post, isAllowed());
-      post.releaseConnection();
+      post.close();
 
       // wait until paragraph is running
       while(p1.getStatus() != Job.Status.RUNNING) {
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/AbstractTestRestApi.java b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/AbstractTestRestApi.java
index b6c626d..7fd279c 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/AbstractTestRestApi.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/AbstractTestRestApi.java
@@ -23,18 +23,25 @@ import com.google.gson.JsonParser;
 import org.apache.commons.exec.CommandLine;
 import org.apache.commons.exec.DefaultExecutor;
 import org.apache.commons.exec.PumpStreamHandler;
-import org.apache.commons.httpclient.Header;
-import org.apache.commons.httpclient.HttpClient;
-import org.apache.commons.httpclient.HttpMethodBase;
-import org.apache.commons.httpclient.cookie.CookiePolicy;
-import org.apache.commons.httpclient.methods.ByteArrayRequestEntity;
-import org.apache.commons.httpclient.methods.DeleteMethod;
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.httpclient.methods.PostMethod;
-import org.apache.commons.httpclient.methods.PutMethod;
-import org.apache.commons.httpclient.methods.RequestEntity;
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.http.Header;
+import org.apache.http.HttpResponse;
+import org.apache.http.HttpStatus;
+import org.apache.http.NameValuePair;
+import org.apache.http.client.config.CookieSpecs;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.entity.UrlEncodedFormEntity;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpDelete;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.client.methods.HttpPut;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.message.BasicNameValuePair;
 import org.apache.zeppelin.notebook.Notebook;
 import org.apache.zeppelin.plugin.PluginManager;
 import org.apache.zeppelin.utils.TestUtils;
@@ -49,6 +56,8 @@ import java.io.IOException;
 import java.lang.ref.WeakReference;
 import java.net.InetAddress;
 import java.net.UnknownHostException;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
@@ -61,7 +70,7 @@ import org.apache.zeppelin.server.ZeppelinServer;
 public abstract class AbstractTestRestApi {
   protected static final Logger LOG = LoggerFactory.getLogger(AbstractTestRestApi.class);
 
-  static final String REST_API_URL = "/api";
+  public static final String REST_API_URL = "/api";
   static final String URL = getUrlToTest();
   protected static final boolean WAS_RUNNING = checkIfServerIsRunning();
   static boolean isRunningWithAuth = false;
@@ -89,10 +98,7 @@ public abstract class AbstractTestRestApi {
           "/** = authc";
 
   private static String zeppelinShiroKnox =
-      "[users]\n" +
-          "admin = password1, admin\n" +
-          "user1 = password2, role1, role2\n" +
-          "[main]\n" +
+           "[main]\n" +
           "knoxJwtRealm = org.apache.zeppelin.realm.jwt.KnoxJwtRealm\n" +
           "knoxJwtRealm.providerUrl = https://domain.example.com/\n" +
           "knoxJwtRealm.login = gateway/knoxsso/knoxauth/login.html\n" +
@@ -135,6 +141,15 @@ public abstract class AbstractTestRestApi {
   protected static File confDir;
   protected static File notebookDir;
 
+  private static CloseableHttpClient httpClient;
+
+  public static CloseableHttpClient getHttpClient() {
+    if (httpClient == null) {
+      httpClient = HttpClients.createDefault();
+    }
+    return httpClient;
+  }
+
   private String getUrl(String path) {
     String url;
     if (System.getProperty("url") != null) {
@@ -201,7 +216,7 @@ public abstract class AbstractTestRestApi {
       System.setProperty(
           ZeppelinConfiguration.ConfVars.ZEPPELIN_INTERPRETER_GROUP_DEFAULT.getVarName(),
           "spark");
-      
+
       notebookDir = new File(zeppelinHome.getAbsolutePath() + "/notebook_" + testClassName);
       if (cleanData) {
         FileUtils.deleteDirectory(notebookDir);
@@ -230,14 +245,15 @@ public abstract class AbstractTestRestApi {
         }
         if (withKnox) {
           FileUtils.writeStringToFile(shiroIni,
-              zeppelinShiroKnox.replaceAll("knox-sso.pem", confDir + "/knox-sso.pem"));
+              zeppelinShiroKnox.replaceAll("knox-sso.pem", confDir + "/knox-sso.pem"),
+              StandardCharsets.UTF_8);
           knoxSsoPem = new File(confDir, "knox-sso.pem");
           if (!knoxSsoPem.exists()) {
             knoxSsoPem.createNewFile();
           }
-          FileUtils.writeStringToFile(knoxSsoPem, knoxSsoPemCertificate);
+          FileUtils.writeStringToFile(knoxSsoPem, knoxSsoPemCertificate, StandardCharsets.UTF_8);
         } else {
-          FileUtils.writeStringToFile(shiroIni, zeppelinShiro);
+          FileUtils.writeStringToFile(shiroIni, zeppelinShiro, StandardCharsets.UTF_8);
         }
 
       }
@@ -345,158 +361,147 @@ public abstract class AbstractTestRestApi {
     }
   }
 
-  protected static boolean checkIfServerIsRunning() {
-    GetMethod request = null;
+  public static boolean checkIfServerIsRunning() {
     boolean isRunning;
-    try {
-      request = httpGet("/version");
-      isRunning = request.getStatusCode() == 200;
+    try (CloseableHttpResponse response = httpGet("/version")) {
+      isRunning = response.getStatusLine().getStatusCode() == 200;
     } catch (IOException e) {
       LOG.error("AbstractTestRestApi.checkIfServerIsRunning() fails .. ZeppelinServer is not " +
-              "running");
+          "running");
       isRunning = false;
-    } finally {
-      if (request != null) {
-        request.releaseConnection();
-      }
     }
     return isRunning;
   }
 
-  protected static GetMethod httpGet(String path) throws IOException {
+  public static CloseableHttpResponse httpGet(String path) throws IOException {
     return httpGet(path, StringUtils.EMPTY, StringUtils.EMPTY);
   }
 
-  protected static GetMethod httpGet(String path, String user, String pwd) throws IOException {
+  public static CloseableHttpResponse httpGet(String path, String user, String pwd) throws IOException {
     return httpGet(path, user, pwd, StringUtils.EMPTY);
   }
 
-  protected static GetMethod httpGet(String path, String user, String pwd, String cookies)
-          throws IOException {
+  public static CloseableHttpResponse httpGet(String path, String user, String pwd, String cookies)
+    throws IOException {
     LOG.info("Connecting to {}", URL + path);
-    HttpClient httpClient = new HttpClient();
-    GetMethod getMethod = new GetMethod(URL + path);
-    getMethod.addRequestHeader("Origin", URL);
+    HttpGet httpGet = new HttpGet(URL + path);
+    httpGet.addHeader("Origin", URL);
     if (userAndPasswordAreNotBlank(user, pwd)) {
-      getMethod.setRequestHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
+      httpGet.setHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
     }
     if (!StringUtils.isBlank(cookies)) {
-      getMethod.setRequestHeader("Cookie", getMethod.getResponseHeader("Cookie") + ";" + cookies);
+      httpGet.setHeader("Cookie", httpGet.getFirstHeader("Cookie") + ";" + cookies);
     }
-    httpClient.executeMethod(getMethod);
-    LOG.info("{} - {}", getMethod.getStatusCode(), getMethod.getStatusText());
-    return getMethod;
+    CloseableHttpResponse response = getHttpClient().execute(httpGet);
+    LOG.info("{} - {}", response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase());
+    return response;
   }
 
-  protected static DeleteMethod httpDelete(String path) throws IOException {
+  public static CloseableHttpResponse httpDelete(String path) throws IOException {
     return httpDelete(path, StringUtils.EMPTY, StringUtils.EMPTY);
   }
 
-  protected static DeleteMethod httpDelete(String path, String user, String pwd)
-          throws IOException {
+  public static CloseableHttpResponse httpDelete(String path, String user, String pwd)
+      throws IOException {
     LOG.info("Connecting to {}", URL + path);
-    HttpClient httpClient = new HttpClient();
-    DeleteMethod deleteMethod = new DeleteMethod(URL + path);
-    deleteMethod.addRequestHeader("Origin", URL);
+    HttpDelete httpDelete = new HttpDelete(URL + path);
+    httpDelete.addHeader("Origin", URL);
     if (userAndPasswordAreNotBlank(user, pwd)) {
-      deleteMethod.setRequestHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
+      httpDelete.setHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
     }
-    httpClient.executeMethod(deleteMethod);
-    LOG.info("{} - {}", deleteMethod.getStatusCode(), deleteMethod.getStatusText());
-    return deleteMethod;
+    CloseableHttpResponse response = getHttpClient().execute(httpDelete);
+    LOG.info("{} - {}", response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase());
+    return response;
   }
 
-  protected static PostMethod httpPost(String path, String body) throws IOException {
+  public static CloseableHttpResponse httpPost(String path, String body) throws IOException {
     return httpPost(path, body, StringUtils.EMPTY, StringUtils.EMPTY);
   }
 
-  protected static PostMethod httpPost(String path, String request, String user, String pwd)
-          throws IOException {
+  public static CloseableHttpResponse httpPost(String path, String request, String user, String pwd)
+      throws IOException {
     LOG.info("Connecting to {}", URL + path);
-    HttpClient httpClient = new HttpClient();
-    PostMethod postMethod = new PostMethod(URL + path);
-    postMethod.setRequestBody(request);
-    postMethod.getParams().setCookiePolicy(CookiePolicy.IGNORE_COOKIES);
+    RequestConfig localConfig = RequestConfig.custom()
+      .setCookieSpec(CookieSpecs.IGNORE_COOKIES)
+      .build();
+
+    HttpPost httpPost = new HttpPost(URL + path);
+    httpPost.setConfig(localConfig);
+    httpPost.setEntity(new StringEntity(request, ContentType.APPLICATION_JSON));
     if (userAndPasswordAreNotBlank(user, pwd)) {
-      postMethod.setRequestHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
+      httpPost.setHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
     }
-    httpClient.executeMethod(postMethod);
-    LOG.info("{} - {}", postMethod.getStatusCode(), postMethod.getStatusText());
-    return postMethod;
+    CloseableHttpResponse response = getHttpClient().execute(httpPost);
+    LOG.info("{} - {}", response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase());
+    return response;
   }
 
-  protected static PutMethod httpPut(String path, String body) throws IOException {
+  public static CloseableHttpResponse httpPut(String path, String body) throws IOException {
     return httpPut(path, body, StringUtils.EMPTY, StringUtils.EMPTY);
   }
 
-  protected static PutMethod httpPut(String path, String body, String user, String pwd)
-          throws IOException {
+  public static CloseableHttpResponse httpPut(String path, String body, String user, String pwd)
+      throws IOException {
     LOG.info("Connecting to {}", URL + path);
-    HttpClient httpClient = new HttpClient();
-    PutMethod putMethod = new PutMethod(URL + path);
-    putMethod.addRequestHeader("Origin", URL);
-    RequestEntity entity = new ByteArrayRequestEntity(body.getBytes("UTF-8"));
-    putMethod.setRequestEntity(entity);
+    HttpPut httpPut = new HttpPut(URL + path);
+    httpPut.addHeader("Origin", URL);
+    httpPut.setEntity(new StringEntity(body, ContentType.TEXT_PLAIN));
     if (userAndPasswordAreNotBlank(user, pwd)) {
-      putMethod.setRequestHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
+      httpPut.setHeader("Cookie", "JSESSIONID=" + getCookie(user, pwd));
     }
-    httpClient.executeMethod(putMethod);
-    LOG.info("{} - {}", putMethod.getStatusCode(), putMethod.getStatusText());
-    return putMethod;
+    CloseableHttpResponse response = getHttpClient().execute(httpPut);
+    LOG.info("{} - {}", response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase());
+    return response;
   }
 
   private static String getCookie(String user, String password) throws IOException {
-    HttpClient httpClient = new HttpClient();
-    PostMethod postMethod = new PostMethod(URL + "/login");
-    postMethod.addRequestHeader("Origin", URL);
-    postMethod.setParameter("password", password);
-    postMethod.setParameter("userName", user);
-    httpClient.executeMethod(postMethod);
-    LOG.info("{} - {}", postMethod.getStatusCode(), postMethod.getStatusText());
-    Pattern pattern = Pattern.compile("JSESSIONID=([a-zA-Z0-9-]*)");
-    Header[] setCookieHeaders = postMethod.getResponseHeaders("Set-Cookie");
-    String jsessionId = null;
-    for (Header setCookie : setCookieHeaders) {
-      java.util.regex.Matcher matcher = pattern.matcher(setCookie.toString());
-      if (matcher.find()) {
-        jsessionId = matcher.group(1);
+    HttpPost httpPost = new HttpPost(URL + "/login");
+    httpPost.addHeader("Origin", URL);
+    ArrayList<NameValuePair> postParameters = new ArrayList<NameValuePair>();
+    postParameters.add(new BasicNameValuePair("password", password));
+    postParameters.add(new BasicNameValuePair("userName", user));
+    httpPost.setEntity(new UrlEncodedFormEntity(postParameters, StandardCharsets.UTF_8));
+    try (CloseableHttpResponse response = getHttpClient().execute(httpPost)) {
+      LOG.info("{} - {}", response.getStatusLine().getStatusCode(), response.getStatusLine().getReasonPhrase());
+      Pattern pattern = Pattern.compile("JSESSIONID=([a-zA-Z0-9-]*)");
+      Header[] setCookieHeaders = response.getHeaders("Set-Cookie");
+      String jsessionId = null;
+      for (Header setCookie : setCookieHeaders) {
+        java.util.regex.Matcher matcher = pattern.matcher(setCookie.toString());
+        if (matcher.find()) {
+          jsessionId = matcher.group(1);
+        }
+      }
+      if (jsessionId != null) {
+        return jsessionId;
+      } else {
+        return StringUtils.EMPTY;
       }
-    }
-
-    if (jsessionId != null) {
-      return jsessionId;
-    } else {
-      return StringUtils.EMPTY;
     }
   }
 
   protected static boolean userAndPasswordAreNotBlank(String user, String pwd) {
-    if (StringUtils.isBlank(user) && StringUtils.isBlank(pwd)) {
-      return false;
-    }
-    return true;
+    return StringUtils.isNoneBlank(user, pwd);
   }
 
-  protected Matcher<HttpMethodBase> responsesWith(final int expectedStatusCode) {
-    return new TypeSafeMatcher<HttpMethodBase>() {
-      WeakReference<HttpMethodBase> method;
+  protected static Matcher<HttpResponse> responsesWith(final int expectedStatusCode) {
+    return new TypeSafeMatcher<HttpResponse>() {
+      WeakReference<HttpResponse> response;
 
       @Override
-      public boolean matchesSafely(HttpMethodBase httpMethodBase) {
-        method = (method == null) ? new WeakReference<>(httpMethodBase) : method;
-        return httpMethodBase.getStatusCode() == expectedStatusCode;
+      public boolean matchesSafely(HttpResponse httpResponse) {
+        response = (response == null) ? new WeakReference<>(httpResponse) : response;
+        return httpResponse.getStatusLine().getStatusCode() == expectedStatusCode;
       }
 
       @Override
       public void describeTo(Description description) {
-        description.appendText("HTTP response ").appendValue(expectedStatusCode)
-            .appendText(" from ").appendText(method.get().getPath());
+        description.appendText("HTTP response ").appendValue(expectedStatusCode);
       }
 
       @Override
-      protected void describeMismatchSafely(HttpMethodBase item, Description description) {
-        description.appendText("got ").appendValue(item.getStatusCode()).appendText(" ")
-            .appendText(item.getStatusText());
+      protected void describeMismatchSafely(HttpResponse item, Description description) {
+        description.appendText("got ").appendValue(item.getStatusLine().getStatusCode());
       }
     };
   }
@@ -584,31 +589,31 @@ public abstract class AbstractTestRestApi {
   /**
    * Status code matcher.
    */
-  protected Matcher<? super HttpMethodBase> isForbidden() {
-    return responsesWith(403);
+  public static Matcher<? super HttpResponse> isForbidden() {
+    return responsesWith(HttpStatus.SC_FORBIDDEN);
   }
 
-  protected Matcher<? super HttpMethodBase> isAllowed() {
-    return responsesWith(200);
+  public static Matcher<? super HttpResponse> isAllowed() {
+    return responsesWith(HttpStatus.SC_OK);
   }
 
-  protected Matcher<? super HttpMethodBase> isCreated() {
-    return responsesWith(201);
+  public static Matcher<? super HttpResponse> isCreated() {
+    return responsesWith(HttpStatus.SC_CREATED);
   }
 
-  protected Matcher<? super HttpMethodBase> isBadRequest() {
-    return responsesWith(400);
+  public static Matcher<? super HttpResponse> isBadRequest() {
+    return responsesWith(HttpStatus.SC_BAD_REQUEST);
   }
 
-  protected Matcher<? super HttpMethodBase> isNotFound() {
-    return responsesWith(404);
+  public static Matcher<? super HttpResponse> isNotFound() {
+    return responsesWith(HttpStatus.SC_NOT_FOUND);
   }
 
-  protected Matcher<? super HttpMethodBase> isNotAllowed() {
-    return responsesWith(405);
+  public static Matcher<? super HttpResponse> isNotAllowed() {
+    return responsesWith(HttpStatus.SC_METHOD_NOT_ALLOWED);
   }
 
-  protected Matcher<? super HttpMethodBase> isExpectationFailed() {
-    return responsesWith(417);
+  public static Matcher<? super HttpResponse> isExpectationFailed() {
+    return responsesWith(HttpStatus.SC_EXPECTATION_FAILED);
   }
 }
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/ConfigurationsRestApiTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/ConfigurationsRestApiTest.java
index bd489b5..7e910e2 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/ConfigurationsRestApiTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/ConfigurationsRestApiTest.java
@@ -23,12 +23,14 @@ import com.google.common.collect.Iterators;
 import com.google.gson.Gson;
 import com.google.gson.reflect.TypeToken;
 
-import org.apache.commons.httpclient.methods.GetMethod;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
 import org.junit.AfterClass;
 import org.junit.BeforeClass;
 import org.junit.Test;
 
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.Map;
 
 public class ConfigurationsRestApiTest extends AbstractTestRestApi {
@@ -46,8 +48,8 @@ public class ConfigurationsRestApiTest extends AbstractTestRestApi {
 
   @Test
   public void testGetAll() throws IOException {
-    GetMethod get = httpGet("/configurations/all");
-    Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+    CloseableHttpResponse get = httpGet("/configurations/all");
+    Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
         new TypeToken<Map<String, Object>>(){}.getType());
     Map<String, String> body = (Map<String, String>) resp.get("body");
     assertTrue(body.size() > 0);
@@ -59,13 +61,14 @@ public class ConfigurationsRestApiTest extends AbstractTestRestApi {
         }
       }
     ));
+    get.close();
   }
 
   @Test
   public void testGetViaPrefix() throws IOException {
     final String prefix = "zeppelin.server";
-    GetMethod get = httpGet("/configurations/prefix/" + prefix);
-    Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+    CloseableHttpResponse get = httpGet("/configurations/prefix/" + prefix);
+    Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
         new TypeToken<Map<String, Object>>(){}.getType());
     Map<String, String> body = (Map<String, String>) resp.get("body");
     assertTrue(body.size() > 0);
@@ -76,5 +79,6 @@ public class ConfigurationsRestApiTest extends AbstractTestRestApi {
           }
         }
     ));
+    get.close();
   }
 }
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/HeliumRestApiTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/HeliumRestApiTest.java
index 00fa5a2..ae205ae 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/HeliumRestApiTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/HeliumRestApiTest.java
@@ -24,8 +24,8 @@ import com.google.gson.Gson;
 import com.google.gson.internal.StringMap;
 import com.google.gson.reflect.TypeToken;
 
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.httpclient.methods.PostMethod;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
 import org.apache.zeppelin.helium.Helium;
 import org.apache.zeppelin.utils.TestUtils;
 import org.junit.After;
@@ -35,6 +35,7 @@ import org.junit.BeforeClass;
 import org.junit.Test;
 
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
@@ -94,127 +95,137 @@ public class HeliumRestApiTest extends AbstractTestRestApi {
 
   @Test
   public void testGetAllPackageInfo() throws IOException {
-    GetMethod get = httpGet("/helium/package");
+    CloseableHttpResponse get = httpGet("/helium/package");
     assertThat(get, isAllowed());
-    Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+    Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() { }.getType());
     Map<String, Set<String>> body = (Map<String, Set<String>>) resp.get("body");
 
     assertEquals(2, body.size());
     assertTrue(body.containsKey("name1"));
     assertTrue(body.containsKey("name2"));
+    get.close();
   }
 
   @Test
   public void testGetAllEnabledPackageInfo() throws IOException {
     // No enabled packages initially
-    GetMethod get1 = httpGet("/helium/enabledPackage");
+    CloseableHttpResponse get1 = httpGet("/helium/enabledPackage");
     assertThat(get1, isAllowed());
-    Map<String, Object> resp1 = gson.fromJson(get1.getResponseBodyAsString(),
+    Map<String, Object> resp1 = gson.fromJson(EntityUtils.toString(get1.getEntity(), StandardCharsets.UTF_8),
                 new TypeToken<Map<String, Object>>() { }.getType());
     List<StringMap<Object>> body1 = (List<StringMap<Object>>) resp1.get("body");
-    assertEquals(body1.size(), 0);
+    assertEquals(0, body1.size());
 
     // Enable "name1" package
     helium.enable("name1", "artifact1");
 
-    GetMethod get2 = httpGet("/helium/enabledPackage");
+    CloseableHttpResponse get2 = httpGet("/helium/enabledPackage");
     assertThat(get2, isAllowed());
-    Map<String, Object> resp2 = gson.fromJson(get2.getResponseBodyAsString(),
+    Map<String, Object> resp2 = gson.fromJson(EntityUtils.toString(get2.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() { }.getType());
     List<StringMap<Object>> body2 = (List<StringMap<Object>>) resp2.get("body");
 
-    assertEquals(body2.size(), 1);
+    assertEquals(1, body2.size());
     StringMap<Object> pkg = (StringMap<Object>) body2.get(0).get("pkg");
-    assertEquals(pkg.get("name"), "name1");
+    assertEquals("name1", pkg.get("name"));
+    get1.close();
+    get2.close();
   }
 
   @Test
   public void testGetSinglePackageInfo() throws IOException {
     String packageName = "name1";
-    GetMethod get = httpGet("/helium/package/" + packageName);
+    CloseableHttpResponse get = httpGet("/helium/package/" + packageName);
     assertThat(get, isAllowed());
-    Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+    Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() { }.getType());
     List<StringMap<Object>> body = (List<StringMap<Object>>) resp.get("body");
 
-    assertEquals(body.size(), 1);
+    assertEquals(1, body.size());
     StringMap<Object> pkg = (StringMap<Object>) body.get(0).get("pkg");
-    assertEquals(pkg.get("name"), "name1");
+    assertEquals("name1", pkg.get("name"));
+    get.close();
   }
 
   @Test
   public void testGetAllPackageConfigs() throws IOException {
-    GetMethod get = httpGet("/helium/config/");
+    CloseableHttpResponse get = httpGet("/helium/config/");
     assertThat(get, isAllowed());
-    Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+    Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() { }.getType());
     StringMap<Object> body = (StringMap<Object>) resp.get("body");
     // ToDo: Apply config with POST command and check update
-    assertEquals(body.size(), 0);
+    assertEquals(0, body.size());
+    get.close();
   }
 
   @Test
   public void testGetPackageConfig() throws IOException {
     String packageName = "name1";
     String artifact = "artifact1";
-    GetMethod get = httpGet("/helium/config/" + packageName + "/" + artifact);
+    CloseableHttpResponse get = httpGet("/helium/config/" + packageName + "/" + artifact);
     assertThat(get, isAllowed());
-    Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+    Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() { }.getType());
     StringMap<Object> body = (StringMap<Object>) resp.get("body");
     assertTrue(body.containsKey("confPersisted"));
+    get.close();
   }
 
   @Test
   public void testEnableDisablePackage() throws IOException {
     String packageName = "name1";
-    PostMethod post1 = httpPost("/helium/enable/" + packageName, "");
+    CloseableHttpResponse post1 = httpPost("/helium/enable/" + packageName, "");
     assertThat(post1, isAllowed());
-    post1.releaseConnection();
+    post1.close();
 
-    GetMethod get1 = httpGet("/helium/package/" + packageName);
-    Map<String, Object> resp1 = gson.fromJson(get1.getResponseBodyAsString(),
+    CloseableHttpResponse get1 = httpGet("/helium/package/" + packageName);
+    Map<String, Object> resp1 = gson.fromJson(EntityUtils.toString(get1.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() { }.getType());
     List<StringMap<Object>> body1 = (List<StringMap<Object>>) resp1.get("body");
-    assertEquals(body1.get(0).get("enabled"), true);
+    assertEquals(true, body1.get(0).get("enabled"));
+    get1.close();
 
-    PostMethod post2 = httpPost("/helium/disable/" + packageName, "");
+    CloseableHttpResponse post2 = httpPost("/helium/disable/" + packageName, "");
     assertThat(post2, isAllowed());
-    post2.releaseConnection();
+    post2.close();
 
-    GetMethod get2 = httpGet("/helium/package/" + packageName);
-    Map<String, Object> resp2 = gson.fromJson(get2.getResponseBodyAsString(),
+    CloseableHttpResponse get2 = httpGet("/helium/package/" + packageName);
+    Map<String, Object> resp2 = gson.fromJson(EntityUtils.toString(get2.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() { }.getType());
     List<StringMap<Object>> body2 = (List<StringMap<Object>>) resp2.get("body");
-    assertEquals(body2.get(0).get("enabled"), false);
+    assertEquals(false, body2.get(0).get("enabled"));
+    get2.close();
   }
 
   @Test
   public void testVisualizationPackageOrder() throws IOException {
-    GetMethod get1 = httpGet("/helium/order/visualization");
+    CloseableHttpResponse get1 = httpGet("/helium/order/visualization");
     assertThat(get1, isAllowed());
-    Map<String, Object> resp1 = gson.fromJson(get1.getResponseBodyAsString(),
+    Map<String, Object> resp1 = gson.fromJson(EntityUtils.toString(get1.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() { }.getType());
     List<Object> body1 = (List<Object>) resp1.get("body");
-    assertEquals(body1.size(), 0);
+    assertEquals(0, body1.size());
+    get1.close();
 
     //We assume allPackages list has been refreshed before sorting
     helium.getAllPackageInfo();
 
     String postRequestJson = "[name2, name1]";
-    PostMethod post = httpPost("/helium/order/visualization", postRequestJson);
+    CloseableHttpResponse post = httpPost("/helium/order/visualization", postRequestJson);
     assertThat(post, isAllowed());
-    post.releaseConnection();
+    post.close();
 
-    GetMethod get2 = httpGet("/helium/order/visualization");
+    CloseableHttpResponse get2 = httpGet("/helium/order/visualization");
     assertThat(get2, isAllowed());
-    Map<String, Object> resp2 = gson.fromJson(get2.getResponseBodyAsString(),
+    Map<String, Object> resp2 = gson.fromJson(EntityUtils.toString(get2.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() { }.getType());
     List<Object> body2 = (List<Object>) resp2.get("body");
-    assertEquals(body2.size(), 2);
-    assertEquals(body2.get(0), "name2");
-    assertEquals(body2.get(1), "name1");
+    assertEquals(2, body2.size());
+    assertEquals("name2", body2.get(0));
+    assertEquals("name1", body2.get(1));
+    get2.close();
   }
 }
 
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/InterpreterRestApiTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/InterpreterRestApiTest.java
index cb96df2..abfb754 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/InterpreterRestApiTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/InterpreterRestApiTest.java
@@ -21,11 +21,9 @@ import com.google.gson.JsonArray;
 import com.google.gson.JsonElement;
 import com.google.gson.JsonObject;
 import com.google.gson.reflect.TypeToken;
-import org.apache.commons.httpclient.methods.DeleteMethod;
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.httpclient.methods.PostMethod;
-import org.apache.commons.httpclient.methods.PutMethod;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
 import org.apache.zeppelin.interpreter.InterpreterOption;
 import org.apache.zeppelin.interpreter.InterpreterSetting;
 import org.apache.zeppelin.notebook.Note;
@@ -43,12 +41,14 @@ import org.junit.Test;
 import org.junit.runners.MethodSorters;
 
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
 
 /**
  * Zeppelin interpreter rest api tests.
@@ -76,36 +76,37 @@ public class InterpreterRestApiTest extends AbstractTestRestApi {
   @Test
   public void getAvailableInterpreters() throws IOException {
     // when
-    GetMethod get = httpGet("/interpreter");
-    JsonObject body = getBodyFieldFromResponse(get.getResponseBodyAsString());
+    CloseableHttpResponse get = httpGet("/interpreter");
+    JsonObject body = getBodyFieldFromResponse(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8));
 
     // then
     assertThat(get, isAllowed());
     assertEquals(TestUtils.getInstance(Notebook.class).getInterpreterSettingManager()
                     .getInterpreterSettingTemplates().size(), body.entrySet().size());
-    get.releaseConnection();
+    get.close();
   }
 
   @Test
   public void getSettings() throws IOException {
     // when
-    GetMethod get = httpGet("/interpreter/setting");
+    CloseableHttpResponse get = httpGet("/interpreter/setting");
     // then
     assertThat(get, isAllowed());
     // DO NOT REMOVE: implies that body is properly parsed as an array
-    JsonArray body = getArrayBodyFieldFromResponse(get.getResponseBodyAsString());
-    get.releaseConnection();
+    JsonArray body = getArrayBodyFieldFromResponse(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8));
+    assertNotNull(body);
+    get.close();
   }
 
   @Test
   public void testGetNonExistInterpreterSetting() throws IOException {
     // when
     String nonExistInterpreterSettingId = "apache_.zeppelin_1s_.aw3some$";
-    GetMethod get = httpGet("/interpreter/setting/" + nonExistInterpreterSettingId);
+    CloseableHttpResponse get = httpGet("/interpreter/setting/" + nonExistInterpreterSettingId);
 
     // then
     assertThat("Test get method:", get, isNotFound());
-    get.releaseConnection();
+    get.close();
   }
 
   @Test
@@ -118,24 +119,24 @@ public class InterpreterRestApiTest extends AbstractTestRestApi {
             "\"name\":\"md\"}],\"dependencies\":[]," +
             "\"option\": { \"remote\": true, \"session\": false }}";
     JsonObject jsonRequest = gson.fromJson(rawRequest, JsonElement.class).getAsJsonObject();
-    PostMethod post = httpPost("/interpreter/setting/", jsonRequest.toString());
-    String postResponse = post.getResponseBodyAsString();
-    LOG.info("testSettingCRUD create response\n" + post.getResponseBodyAsString());
+    CloseableHttpResponse post = httpPost("/interpreter/setting/", jsonRequest.toString());
+    String postResponse = EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8);
+    LOG.info("testSettingCRUD create response\n" + postResponse);
     InterpreterSetting created = convertResponseToInterpreterSetting(postResponse);
     String newSettingId = created.getId();
     // then : call create setting API
     assertThat("test create method:", post, isAllowed());
-    post.releaseConnection();
+    post.close();
 
     // when: call read setting API
-    GetMethod get = httpGet("/interpreter/setting/" + newSettingId);
-    String getResponse = get.getResponseBodyAsString();
+    CloseableHttpResponse get = httpGet("/interpreter/setting/" + newSettingId);
+    String getResponse = EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8);
     LOG.info("testSettingCRUD get response\n" + getResponse);
     InterpreterSetting previouslyCreated = convertResponseToInterpreterSetting(getResponse);
     // then : read Setting API
     assertThat("Test get method:", get, isAllowed());
     assertEquals(newSettingId, previouslyCreated.getId());
-    get.releaseConnection();
+    get.close();
 
     // when: call update setting API
     JsonObject jsonObject = new JsonObject();
@@ -143,18 +144,18 @@ public class InterpreterRestApiTest extends AbstractTestRestApi {
     jsonObject.addProperty("value", "this is new prop");
     jsonObject.addProperty("type", "textarea");
     jsonRequest.getAsJsonObject("properties").add("propname2", jsonObject);
-    PutMethod put = httpPut("/interpreter/setting/" + newSettingId, jsonRequest.toString());
-    LOG.info("testSettingCRUD update response\n" + put.getResponseBodyAsString());
+    CloseableHttpResponse put = httpPut("/interpreter/setting/" + newSettingId, jsonRequest.toString());
+    LOG.info("testSettingCRUD update response\n" + EntityUtils.toString(put.getEntity(), StandardCharsets.UTF_8));
     // then: call update setting API
     assertThat("test update method:", put, isAllowed());
-    put.releaseConnection();
+    put.close();
 
     // when: call delete setting API
-    DeleteMethod delete = httpDelete("/interpreter/setting/" + newSettingId);
-    LOG.info("testSettingCRUD delete response\n" + delete.getResponseBodyAsString());
+    CloseableHttpResponse delete = httpDelete("/interpreter/setting/" + newSettingId);
+    LOG.info("testSettingCRUD delete response\n" +  EntityUtils.toString(delete.getEntity(), StandardCharsets.UTF_8));
     // then: call delete setting API
     assertThat("Test delete method:", delete, isAllowed());
-    delete.releaseConnection();
+    delete.close();
   }
 
   @Test
@@ -176,9 +177,9 @@ public class InterpreterRestApiTest extends AbstractTestRestApi {
             "      \"exclusions\":[]\n" +
             "    }]," +
             "\"option\": { \"remote\": true, \"session\": false }}";
-    PostMethod post = httpPost("/interpreter/setting", reqBody1);
+    CloseableHttpResponse post = httpPost("/interpreter/setting", reqBody1);
     assertThat("test create method:", post, isAllowed());
-    post.releaseConnection();
+    post.close();
 
     String reqBody2 = "{\"name\":\"" + md2Name + "\",\"group\":\"md\"," +
             "\"properties\": {\"propname\": {\"value\": \"propvalue\", \"name\": \"propname\", " +
@@ -192,12 +193,12 @@ public class InterpreterRestApiTest extends AbstractTestRestApi {
             "\"option\": { \"remote\": true, \"session\": false }}";
     post = httpPost("/interpreter/setting", reqBody2);
     assertThat("test create method:", post, isAllowed());
-    post.releaseConnection();
+    post.close();
 
     // 1. Call settings API
-    GetMethod get = httpGet("/interpreter/setting");
-    String rawResponse = get.getResponseBodyAsString();
-    get.releaseConnection();
+    CloseableHttpResponse get = httpGet("/interpreter/setting");
+    String rawResponse = EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8);
+    get.close();
 
     // 2. Parsing to List<InterpreterSettings>
     JsonObject responseJson = gson.fromJson(rawResponse, JsonElement.class).getAsJsonObject();
@@ -229,10 +230,10 @@ public class InterpreterRestApiTest extends AbstractTestRestApi {
   @Test
   public void testSettingsCreateWithEmptyJson() throws IOException {
     // Call Create Setting REST API
-    PostMethod post = httpPost("/interpreter/setting/", "");
-    LOG.info("testSettingCRUD create response\n" + post.getResponseBodyAsString());
+    CloseableHttpResponse post = httpPost("/interpreter/setting/", "");
+    LOG.info("testSettingCRUD create response\n" + EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8));
     assertThat("test create method:", post, isBadRequest());
-    post.releaseConnection();
+    post.close();
   }
 
   @Test
@@ -260,34 +261,34 @@ public class InterpreterRestApiTest extends AbstractTestRestApi {
         + "}"
         + "}";
     JsonObject jsonRequest = gson.fromJson(StringUtils.replace(reqBody, "mdName", "mdValidName"), JsonElement.class).getAsJsonObject();
-    PostMethod post = httpPost("/interpreter/setting/", jsonRequest.toString());
-    String postResponse = post.getResponseBodyAsString();
-    LOG.info("testSetting with valid name\n" + post.getResponseBodyAsString());
+    CloseableHttpResponse post = httpPost("/interpreter/setting/", jsonRequest.toString());
+    String postResponse = EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8);
+    LOG.info("testSetting with valid name\n" + postResponse);
     InterpreterSetting created = convertResponseToInterpreterSetting(postResponse);
     String newSettingId = created.getId();
     // then : call create setting API
     assertThat("test create method:", post, isAllowed());
-    post.releaseConnection();
+    post.close();
 
     // when: call delete setting API
-    DeleteMethod delete = httpDelete("/interpreter/setting/" + newSettingId);
-    LOG.info("testSetting delete response\n" + delete.getResponseBodyAsString());
+    CloseableHttpResponse delete = httpDelete("/interpreter/setting/" + newSettingId);
+    LOG.info("testSetting delete response\n" + EntityUtils.toString(delete.getEntity(), StandardCharsets.UTF_8));
     // then: call delete setting API
     assertThat("Test delete method:", delete, isAllowed());
-    delete.releaseConnection();
+    delete.close();
 
 
     JsonObject jsonRequest2 = gson.fromJson(StringUtils.replace(reqBody, "mdName", "name space"), JsonElement.class).getAsJsonObject();
-    PostMethod post2 = httpPost("/interpreter/setting/", jsonRequest2.toString());
-    LOG.info("testSetting with name with space\n" + post2.getResponseBodyAsString());
+    CloseableHttpResponse post2 = httpPost("/interpreter/setting/", jsonRequest2.toString());
+    LOG.info("testSetting with name with space\n" + EntityUtils.toString(post2.getEntity(), StandardCharsets.UTF_8));
     assertThat("test create method with space:", post2, isNotFound());
-    post2.releaseConnection();
+    post2.close();
 
     JsonObject jsonRequest3 = gson.fromJson(StringUtils.replace(reqBody, "mdName", ""), JsonElement.class).getAsJsonObject();
-    PostMethod post3 = httpPost("/interpreter/setting/", jsonRequest3.toString());
-    LOG.info("testSetting with empty name\n" + post3.getResponseBodyAsString());
+    CloseableHttpResponse post3 = httpPost("/interpreter/setting/", jsonRequest3.toString());
+    LOG.info("testSetting with empty name\n" + EntityUtils.toString(post3.getEntity(), StandardCharsets.UTF_8));
     assertThat("test create method with empty name:", post3, isNotFound());
-    post3.releaseConnection();
+    post3.close();
 
   }
 
@@ -315,9 +316,9 @@ public class InterpreterRestApiTest extends AbstractTestRestApi {
       for (InterpreterSetting setting : note.getBindedInterpreterSettings(new ArrayList<>())) {
         if (setting.getName().equals("md")) {
           // call restart interpreter API
-          PutMethod put = httpPut("/interpreter/setting/restart/" + setting.getId(), "");
+          CloseableHttpResponse put = httpPut("/interpreter/setting/restart/" + setting.getId(), "");
           assertThat("test interpreter restart:", put, isAllowed());
-          put.releaseConnection();
+          put.close();
           break;
         }
       }
@@ -376,21 +377,21 @@ public class InterpreterRestApiTest extends AbstractTestRestApi {
 
       // Restart isolated mode of Interpreter for note.
       mdIntpSetting.getOption().setPerNote(InterpreterOption.ISOLATED);
-      PutMethod put = httpPut("/interpreter/setting/restart/" + mdIntpSetting.getId(), jsonRequest);
+      CloseableHttpResponse put = httpPut("/interpreter/setting/restart/" + mdIntpSetting.getId(), jsonRequest);
       assertThat("isolated interpreter restart:", put, isAllowed());
-      put.releaseConnection();
+      put.close();
 
       // Restart scoped mode of Interpreter for note.
       mdIntpSetting.getOption().setPerNote(InterpreterOption.SCOPED);
       put = httpPut("/interpreter/setting/restart/" + mdIntpSetting.getId(), jsonRequest);
       assertThat("scoped interpreter restart:", put, isAllowed());
-      put.releaseConnection();
+      put.close();
 
       // Restart shared mode of Interpreter for note.
       mdIntpSetting.getOption().setPerNote(InterpreterOption.SHARED);
       put = httpPut("/interpreter/setting/restart/" + mdIntpSetting.getId(), jsonRequest);
       assertThat("shared interpreter restart:", put, isAllowed());
-      put.releaseConnection();
+      put.close();
 
     } finally {
       if (null != note) {
@@ -401,9 +402,9 @@ public class InterpreterRestApiTest extends AbstractTestRestApi {
 
   @Test
   public void testListRepository() throws IOException {
-    GetMethod get = httpGet("/interpreter/repository");
+    CloseableHttpResponse get = httpGet("/interpreter/repository");
     assertThat(get, isAllowed());
-    get.releaseConnection();
+    get.close();
   }
 
   @Test
@@ -413,14 +414,14 @@ public class InterpreterRestApiTest extends AbstractTestRestApi {
     String jsonRequest = "{\"id\":\"" + repoId +
         "\",\"url\":\"https://repo1.maven.org/maven2\",\"snapshot\":\"false\"}";
 
-    PostMethod post = httpPost("/interpreter/repository/", jsonRequest);
+    CloseableHttpResponse post = httpPost("/interpreter/repository/", jsonRequest);
     assertThat("Test create method:", post, isAllowed());
-    post.releaseConnection();
+    post.close();
 
     // Call delete repository API
-    DeleteMethod delete = httpDelete("/interpreter/repository/" + repoId);
+    CloseableHttpResponse delete = httpDelete("/interpreter/repository/" + repoId);
     assertThat("Test delete method:", delete, isAllowed());
-    delete.releaseConnection();
+    delete.close();
   }
 
   private JsonObject getBodyFieldFromResponse(String rawResponse) {
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/KnoxRestApiTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/KnoxRestApiTest.java
index d0253a8..a74d565 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/KnoxRestApiTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/KnoxRestApiTest.java
@@ -18,17 +18,21 @@ package org.apache.zeppelin.rest;
 
 import com.google.gson.Gson;
 
-import org.apache.commons.httpclient.methods.GetMethod;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
 import org.hamcrest.CoreMatchers;
 import org.junit.AfterClass;
 import org.junit.Before;
 import org.junit.BeforeClass;
+import org.junit.Ignore;
 import org.junit.Rule;
+import org.junit.Test;
 import org.junit.rules.ErrorCollector;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.Map;
 
 public class KnoxRestApiTest extends AbstractTestRestApi {
@@ -58,22 +62,18 @@ public class KnoxRestApiTest extends AbstractTestRestApi {
   public void setUp() {
   }
 
-  //  @Test
+  @Test
+  @Ignore
   public void testThatOtherUserCanAccessNoteIfPermissionNotSet() throws IOException {
-    GetMethod loginWithoutCookie = httpGet("/api/security/ticket");
-    Map result = gson.fromJson(loginWithoutCookie.getResponseBodyAsString(), Map.class);
-    collector.checkThat("Path is redirected to /login", loginWithoutCookie.getPath(),
-        CoreMatchers.containsString("login"));
-
-    collector.checkThat("Path is redirected to /login", loginWithoutCookie.getPath(),
-        CoreMatchers.containsString("login"));
+    CloseableHttpResponse loginWithoutCookie = httpGet("/api/security/ticket");
+    Map result = gson.fromJson(EntityUtils.toString(loginWithoutCookie.getEntity(), StandardCharsets.UTF_8), Map.class);
 
     collector.checkThat("response contains redirect URL",
         ((Map) result.get("body")).get("redirectURL").toString(), CoreMatchers.equalTo(
             "https://domain.example.com/gateway/knoxsso/knoxauth/login.html?originalUrl="));
 
-    GetMethod loginWithCookie = httpGet("/api/security/ticket", "", "", knoxCookie);
-    result = gson.fromJson(loginWithCookie.getResponseBodyAsString(), Map.class);
+    CloseableHttpResponse loginWithCookie = httpGet("/api/security/ticket", "", "", knoxCookie);
+    result = gson.fromJson(EntityUtils.toString(loginWithCookie.getEntity(), StandardCharsets.UTF_8), Map.class);
 
     collector.checkThat("User logged in as admin",
         ((Map) result.get("body")).get("principal").toString(), CoreMatchers.equalTo("admin"));
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookRepoRestApiTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookRepoRestApiTest.java
index 46ea712..aca79c2 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookRepoRestApiTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookRepoRestApiTest.java
@@ -24,9 +24,9 @@ import static org.junit.Assert.assertThat;
 import com.google.gson.Gson;
 import com.google.gson.reflect.TypeToken;
 
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.httpclient.methods.PutMethod;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
 import org.junit.AfterClass;
 import org.junit.Before;
 import org.junit.BeforeClass;
@@ -35,6 +35,7 @@ import org.junit.Test;
 import org.junit.runners.MethodSorters;
 
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.List;
 import java.util.Map;
 
@@ -57,27 +58,27 @@ public class NotebookRepoRestApiTest extends AbstractTestRestApi {
   public static void destroy() throws Exception {
     AbstractTestRestApi.shutDown();
   }
-  
+
   @Before
   public void setUp() {
     anonymous = new AuthenticationInfo("anonymous");
   }
-  
+
   private List<Map<String, Object>> getListOfReposotiry() throws IOException {
-    GetMethod get = httpGet("/notebook-repositories");
-    Map<String, Object> responce = gson.fromJson(get.getResponseBodyAsString(),
+    CloseableHttpResponse get = httpGet("/notebook-repositories");
+    Map<String, Object> responce = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() {}.getType());
-    get.releaseConnection();
+    get.close();
     return (List<Map<String, Object>>) responce.get("body");
   }
-  
+
   private void updateNotebookRepoWithNewSetting(String payload) throws IOException {
-    PutMethod put = httpPut("/notebook-repositories", payload);
-    int status = put.getStatusCode();
-    put.releaseConnection();
+    CloseableHttpResponse put = httpPut("/notebook-repositories", payload);
+    int status = put.getStatusLine().getStatusCode();
+    put.close();
     assertThat(status, is(200));
   }
-  
+
   @Test
   public void thatCanGetNotebookRepositoiesSettings() throws IOException {
     List<Map<String, Object>> listOfRepositories = getListOfReposotiry();
@@ -86,12 +87,12 @@ public class NotebookRepoRestApiTest extends AbstractTestRestApi {
 
   @Test
   public void reloadRepositories() throws IOException {
-    GetMethod get = httpGet("/notebook-repositories/reload");
-    int status = get.getStatusCode();
-    get.releaseConnection();
-    assertThat(status, is(200)); 
+    CloseableHttpResponse get = httpGet("/notebook-repositories/reload");
+    int status = get.getStatusLine().getStatusCode();
+    get.close();
+    assertThat(status, is(200));
   }
-  
+
   @Test
   public void setNewDirectoryForLocalDirectory() throws IOException {
     List<Map<String, Object>> listOfRepositories = getListOfReposotiry();
@@ -116,7 +117,7 @@ public class NotebookRepoRestApiTest extends AbstractTestRestApi {
     String payload = "{ \"name\": \"" + className + "\", \"settings\" : " +
             "{ \"Notebook Path\" : \"/tmp/newDir\" } }";
     updateNotebookRepoWithNewSetting(payload);
-    
+
     // Verify
     listOfRepositories = getListOfReposotiry();
     String updatedPath = StringUtils.EMPTY;
@@ -129,7 +130,7 @@ public class NotebookRepoRestApiTest extends AbstractTestRestApi {
       }
     }
     assertThat(updatedPath, anyOf(is("/tmp/newDir"), is("/tmp/newDir/")));
-    
+
     // go back to normal
     payload = "{ \"name\": \"" + className + "\", \"settings\" : { \"Notebook Path\" : \"" +
             localVfs + "\" } }";
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookRestApiTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookRestApiTest.java
index 885a78d..e3a9bd8 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookRestApiTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookRestApiTest.java
@@ -27,9 +27,6 @@ import com.google.gson.Gson;
 import com.google.gson.internal.StringMap;
 import com.google.gson.reflect.TypeToken;
 
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.httpclient.methods.PostMethod;
-import org.apache.commons.httpclient.methods.PutMethod;
 import org.apache.zeppelin.interpreter.InterpreterSetting;
 import org.apache.zeppelin.interpreter.InterpreterSettingManager;
 import org.apache.zeppelin.notebook.Notebook;
@@ -44,11 +41,14 @@ import org.junit.Test;
 import org.junit.runners.MethodSorters;
 
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
 import org.apache.zeppelin.interpreter.InterpreterResult;
 import org.apache.zeppelin.notebook.Note;
 import org.apache.zeppelin.notebook.Paragraph;
@@ -89,15 +89,16 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
 
       String paragraphId = note1.getLastParagraph().getId();
 
-      GetMethod get = httpGet("/notebook/job/" + note1.getId() + "/" + paragraphId);
+      CloseableHttpResponse get = httpGet("/notebook/job/" + note1.getId() + "/" + paragraphId);
       assertThat(get, isAllowed());
-      Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
       Map<String, Set<String>> paragraphStatus = (Map<String, Set<String>>) resp.get("body");
 
       // Check id and status have proper value
       assertEquals(paragraphStatus.get("id"), paragraphId);
       assertEquals(paragraphStatus.get("status"), "READY");
+      get.close();
     } finally {
       // cleanup
       if (null != note1) {
@@ -117,23 +118,23 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       Paragraph p = note1.addNewParagraph(AuthenticationInfo.ANONYMOUS);
 
       // run blank paragraph
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() + "/" + p.getId(), "");
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() + "/" + p.getId(), "");
       assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
       p.waitUntilFinished();
-      assertEquals(p.getStatus(), Job.Status.FINISHED);
+      assertEquals(Job.Status.FINISHED, p.getStatus());
 
       // run non-blank paragraph
       p.setText("test");
       post = httpPost("/notebook/job/" + note1.getId() + "/" + p.getId(), "");
       assertThat(post, isAllowed());
-      resp = gson.fromJson(post.getResponseBodyAsString(),
+      resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
       p.waitUntilFinished();
       assertNotEquals(p.getStatus(), Job.Status.FINISHED);
     } finally {
@@ -160,12 +161,12 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       p.setTitle(title);
       p.setText(text);
 
-      PostMethod post = httpPost("/notebook/run/" + note1.getId() + "/" + p.getId(), "");
+      CloseableHttpResponse post = httpPost("/notebook/run/" + note1.getId() + "/" + p.getId(), "");
       assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
           new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
       assertNotEquals(p.getStatus(), Job.Status.READY);
 
       // Check if the paragraph is emptied
@@ -178,8 +179,8 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       p.setText(text);
 
       post = httpPost("/notebook/run/" + note1.getId() + "/" + p.getId(), "");
-      assertEquals(200, post.getStatusCode());
-      resp = gson.fromJson(post.getResponseBodyAsString(),
+      assertEquals(200, post.getStatusLine().getStatusCode());
+      resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
       assertEquals("OK", resp.get("status"));
       StringMap stringMap = (StringMap) resp.get("body");
@@ -187,7 +188,7 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       List<StringMap> interpreterResults = (List<StringMap>) stringMap.get("msg");
       assertTrue(interpreterResults.get(0).toString(),
               interpreterResults.get(0).get("data").toString().contains("invalid_cmd: command not found"));
-      post.releaseConnection();
+      post.close();
       assertNotEquals(p.getStatus(), Job.Status.READY);
 
       // Check if the paragraph is emptied
@@ -223,12 +224,12 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       p1.setText("%python from __future__ import print_function\nimport time\ntime.sleep(1)\nuser='abc'");
       p2.setText("%python print(user)");
 
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
       assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
 
       assertEquals(Job.Status.FINISHED, p1.getStatus());
       assertEquals(Job.Status.FINISHED, p2.getStatus());
@@ -263,12 +264,12 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       p1.setText("%python import time\ntime.sleep(5)\nname='hello'\nz.put('name', name)");
       p2.setText("%sh(interpolate=true) echo '{name}'");
 
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
       assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
 
       p1.waitUntilFinished();
       p2.waitUntilFinished();
@@ -311,12 +312,12 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       p1.setText("%python from __future__ import print_function\nimport time\ntime.sleep(1)\nuser='abc'");
       p2.setText("%python print(user)");
 
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true&isolated=true", "");
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true&isolated=true", "");
       assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
 
       assertEquals(Job.Status.FINISHED, p1.getStatus());
       assertEquals(Job.Status.FINISHED, p2.getStatus());
@@ -359,12 +360,12 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       p1.setText("%python from __future__ import print_function\nimport time\ntime.sleep(1)\nuser='abc'");
       p2.setText("%python print(user)");
 
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() + "?blocking=false&isolated=true", "");
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() + "?blocking=false&isolated=true", "");
       assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
 
       // wait for all the paragraphs are done
       while(note1.isRunning()) {
@@ -406,13 +407,13 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       Map<String, Object> paramsMap = new HashMap<>();
       paramsMap.put("name", "zeppelin");
       ParametersRequest parametersRequest = new ParametersRequest(paramsMap);
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() + "?blocking=false&isolated=true&",
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() + "?blocking=false&isolated=true&",
               parametersRequest.toJson());
       assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK",resp.get("status"));
+      post.close();
 
       // wait for all the paragraphs are done
       while(note1.isRunning()) {
@@ -426,10 +427,10 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       // another attempt rest api call without params
       post = httpPost("/notebook/job/" + note1.getId() + "?blocking=false&isolated=true", "");
       assertThat(post, isAllowed());
-      resp = gson.fromJson(post.getResponseBodyAsString(),
+      resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post.close();
 
       // wait for all the paragraphs are done
       while(note1.isRunning()) {
@@ -471,12 +472,13 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       p1.setText("%python from __future__ import print_function\nimport time\ntime.sleep(1)\nprint(user2)");
       p2.setText("%python user2='abc'\nprint(user2)");
 
-      PostMethod post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
+      CloseableHttpResponse post = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
       assertThat(post, isAllowed());
 
       assertEquals(Job.Status.ERROR, p1.getStatus());
       // p2 will be skipped because p1 is failed.
       assertEquals(Job.Status.READY, p2.getStatus());
+      post.close();
     } finally {
       // cleanup
       if (null != note1) {
@@ -492,22 +494,23 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
     String clonedNoteId = null;
     try {
       note1 = TestUtils.getInstance(Notebook.class).createNote("note1", anonymous);
-      PostMethod post = httpPost("/notebook/" + note1.getId(), "");
-      LOG.info("testCloneNote response\n" + post.getResponseBodyAsString());
+      CloseableHttpResponse post = httpPost("/notebook/" + note1.getId(), "");
+      String postResponse = EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8);
+      LOG.info("testCloneNote response\n" + postResponse);
       assertThat(post, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(postResponse,
               new TypeToken<Map<String, Object>>() {}.getType());
       clonedNoteId = (String) resp.get("body");
-      post.releaseConnection();
+      post.close();
 
-      GetMethod get = httpGet("/notebook/" + clonedNoteId);
+      CloseableHttpResponse get = httpGet("/notebook/" + clonedNoteId);
       assertThat(get, isAllowed());
-      Map<String, Object> resp2 = gson.fromJson(get.getResponseBodyAsString(),
+      Map<String, Object> resp2 = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
       Map<String, Object> resp2Body = (Map<String, Object>) resp2.get("body");
 
       //    assertEquals(resp2Body.get("name"), "Note " + clonedNoteId);
-      get.releaseConnection();
+      get.close();
     } finally {
       // cleanup
       if (null != note1) {
@@ -535,9 +538,9 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       final String newName = "testName";
       String jsonRequest = "{\"name\": " + newName + "}";
 
-      PutMethod put = httpPut("/notebook/" + noteId + "/rename/", jsonRequest);
+      CloseableHttpResponse put = httpPut("/notebook/" + noteId + "/rename/", jsonRequest);
       assertThat("test testRenameNote:", put, isAllowed());
-      put.releaseConnection();
+      put.close();
 
       assertEquals(note.getName(), newName);
     } finally {
@@ -560,15 +563,15 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       String paragraphId = p.getId();
       String jsonRequest = "{\"colWidth\": 6.0}";
 
-      PutMethod put = httpPut("/notebook/" + noteId + "/paragraph/" + paragraphId + "/config",
+      CloseableHttpResponse put = httpPut("/notebook/" + noteId + "/paragraph/" + paragraphId + "/config",
               jsonRequest);
       assertThat("test testUpdateParagraphConfig:", put, isAllowed());
 
-      Map<String, Object> resp = gson.fromJson(put.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(put.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
       Map<String, Object> respBody = (Map<String, Object>) resp.get("body");
       Map<String, Object> config = (Map<String, Object>) respBody.get("config");
-      put.releaseConnection();
+      put.close();
 
       assertEquals(config.get("colWidth"), 6.0);
       note = TestUtils.getInstance(Notebook.class).getNote(noteId);
@@ -597,26 +600,27 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       p2.setReturn(result, new Throwable());
 
       // clear paragraph result
-      PutMethod put = httpPut("/notebook/" + note.getId() + "/clear", "");
-      LOG.info("test clear paragraph output response\n" + put.getResponseBodyAsString());
+      CloseableHttpResponse put = httpPut("/notebook/" + note.getId() + "/clear", "");
+      LOG.info("test clear paragraph output response\n" + EntityUtils.toString(put.getEntity(), StandardCharsets.UTF_8));
       assertThat(put, isAllowed());
-      put.releaseConnection();
+      put.close();
 
       // check if paragraph results are cleared
-      GetMethod get = httpGet("/notebook/" + note.getId() + "/paragraph/" + p1.getId());
+      CloseableHttpResponse get = httpGet("/notebook/" + note.getId() + "/paragraph/" + p1.getId());
       assertThat(get, isAllowed());
-      Map<String, Object> resp1 = gson.fromJson(get.getResponseBodyAsString(),
+      Map<String, Object> resp1 = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
       Map<String, Object> resp1Body = (Map<String, Object>) resp1.get("body");
       assertNull(resp1Body.get("result"));
+      get.close();
 
       get = httpGet("/notebook/" + note.getId() + "/paragraph/" + p2.getId());
       assertThat(get, isAllowed());
-      Map<String, Object> resp2 = gson.fromJson(get.getResponseBodyAsString(),
+      Map<String, Object> resp2 = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
       Map<String, Object> resp2Body = (Map<String, Object>) resp2.get("body");
       assertNull(resp2Body.get("result"));
-      get.releaseConnection();
+      get.close();
     } finally {
       // cleanup
       if (null != note) {
@@ -647,13 +651,13 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       p1.setText("%python from __future__ import print_function\nimport time\ntime.sleep(1)\nuser='abc'");
       p2.setText("%python print(user)");
 
-      PostMethod post1 = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
+      CloseableHttpResponse post1 = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
       assertThat(post1, isAllowed());
-      post1.releaseConnection();
-      PutMethod put = httpPut("/notebook/" + note1.getId() + "/clear", "");
-      LOG.info("test clear paragraph output response\n" + put.getResponseBodyAsString());
+      post1.close();
+      CloseableHttpResponse put = httpPut("/notebook/" + note1.getId() + "/clear", "");
+      LOG.info("test clear paragraph output response\n" + EntityUtils.toString(put.getEntity(), StandardCharsets.UTF_8));
       assertThat(put, isAllowed());
-      put.releaseConnection();
+      put.close();
 
       // restart server (while keeping interpreter configuration)
       AbstractTestRestApi.shutDown(false);
@@ -663,12 +667,12 @@ public class NotebookRestApiTest extends AbstractTestRestApi {
       p1 = note1.getParagraph(p1.getId());
       p2 = note1.getParagraph(p2.getId());
 
-      PostMethod post2 = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
+      CloseableHttpResponse post2 = httpPost("/notebook/job/" + note1.getId() + "?blocking=true", "");
       assertThat(post2, isAllowed());
-      Map<String, Object> resp = gson.fromJson(post2.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post2.getEntity(), StandardCharsets.UTF_8),
           new TypeToken<Map<String, Object>>() {}.getType());
-      assertEquals(resp.get("status"), "OK");
-      post2.releaseConnection();
+      assertEquals("OK", resp.get("status"));
+      post2.close();
 
       assertEquals(Job.Status.FINISHED, p1.getStatus());
       assertEquals(p2.getReturn().toString(), Job.Status.FINISHED, p2.getStatus());
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookSecurityRestApiTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookSecurityRestApiTest.java
index a3d67c8..84b7c35 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookSecurityRestApiTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/NotebookSecurityRestApiTest.java
@@ -16,7 +16,7 @@
  */
 package org.apache.zeppelin.rest;
 
-import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.Matchers.is;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertThat;
@@ -24,12 +24,11 @@ import static org.junit.Assert.assertThat;
 import com.google.gson.Gson;
 import com.google.gson.reflect.TypeToken;
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.Map;
-import org.apache.commons.httpclient.HttpMethodBase;
-import org.apache.commons.httpclient.methods.DeleteMethod;
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.httpclient.methods.PostMethod;
-import org.apache.commons.httpclient.methods.PutMethod;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
 import org.apache.zeppelin.notebook.Note;
 import org.apache.zeppelin.notebook.Notebook;
 import org.apache.zeppelin.utils.TestUtils;
@@ -55,7 +54,7 @@ public class NotebookSecurityRestApiTest extends AbstractTestRestApi {
 
   @Before
   public void setUp() {}
-  
+
   @Test
   public void testThatUserCanCreateAndRemoveNote() throws IOException {
     String noteId = createNoteForUser("test_1", "admin", "password1");
@@ -64,83 +63,83 @@ public class NotebookSecurityRestApiTest extends AbstractTestRestApi {
     assertThat(id, is(noteId));
     deleteNoteForUser(noteId, "admin", "password1");
   }
-  
+
   @Test
   public void testThatOtherUserCanAccessNoteIfPermissionNotSet() throws IOException {
     String noteId = createNoteForUser("test_2", "admin", "password1");
-    
+
     userTryGetNote(noteId, "user1", "password2", isAllowed());
-    
+
     deleteNoteForUser(noteId, "admin", "password1");
   }
-  
+
   @Test
   public void testThatOtherUserCannotAccessNoteIfPermissionSet() throws IOException {
     String noteId = createNoteForUser("test_3", "admin", "password1");
-    
+
     //set permission
     String payload = "{ \"owners\": [\"admin\"], \"readers\": [\"user2\"], " +
             "\"runners\": [\"user2\"], \"writers\": [\"user2\"] }";
-    PutMethod put = httpPut("/notebook/" + noteId + "/permissions", payload , "admin", "password1");
+    CloseableHttpResponse put = httpPut("/notebook/" + noteId + "/permissions", payload , "admin", "password1");
     assertThat("test set note permission method:", put, isAllowed());
-    put.releaseConnection();
-    
+    put.close();
+
     userTryGetNote(noteId, "user1", "password2", isForbidden());
-    
+
     userTryGetNote(noteId, "user2", "password3", isAllowed());
-    
+
     deleteNoteForUser(noteId, "admin", "password1");
   }
-  
+
   @Test
   public void testThatWriterCannotRemoveNote() throws IOException {
     String noteId = createNoteForUser("test_4", "admin", "password1");
-    
+
     //set permission
     String payload = "{ \"owners\": [\"admin\", \"user1\"], \"readers\": [\"user2\"], " +
             "\"runners\": [\"user2\"], \"writers\": [\"user2\"] }";
-    PutMethod put = httpPut("/notebook/" + noteId + "/permissions", payload , "admin", "password1");
+    CloseableHttpResponse put = httpPut("/notebook/" + noteId + "/permissions", payload , "admin", "password1");
     assertThat("test set note permission method:", put, isAllowed());
-    put.releaseConnection();
-    
+    put.close();
+
     userTryRemoveNote(noteId, "user2", "password3", isForbidden());
     userTryRemoveNote(noteId, "user1", "password2", isAllowed());
-    
+
     Note deletedNote = TestUtils.getInstance(Notebook.class).getNote(noteId);
     assertNull("Deleted note should be null", deletedNote);
   }
 
   private void userTryRemoveNote(String noteId, String user, String pwd,
-          Matcher<? super HttpMethodBase> m) throws IOException {
-    DeleteMethod delete = httpDelete(("/notebook/" + noteId), user, pwd);
+          Matcher<? super CloseableHttpResponse> m) throws IOException {
+    CloseableHttpResponse delete = httpDelete(("/notebook/" + noteId), user, pwd);
     assertThat(delete, m);
-    delete.releaseConnection();
+    delete.close();
   }
-  
+
   private void userTryGetNote(String noteId, String user, String pwd,
-          Matcher<? super HttpMethodBase> m) throws IOException {
-    GetMethod get = httpGet("/notebook/" + noteId, user, pwd);
+          Matcher<? super CloseableHttpResponse> m) throws IOException {
+    CloseableHttpResponse get = httpGet("/notebook/" + noteId, user, pwd);
     assertThat(get, m);
-    get.releaseConnection();
+    get.close();
   }
 
   private String getNoteIdForUser(String noteId, String user, String pwd) throws IOException {
-    GetMethod get = httpGet("/notebook/" + noteId, user, pwd);
+    CloseableHttpResponse get = httpGet("/notebook/" + noteId, user, pwd);
     assertThat("test note create method:", get, isAllowed());
-    Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+    Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() {}.getType());
-    get.releaseConnection();
+    get.close();
     return (String) ((Map<String, Object>) resp.get("body")).get("id");
   }
-  
+
   private String createNoteForUser(String noteName, String user, String pwd) throws IOException {
     String jsonRequest = "{\"name\":\"" + noteName + "\"}";
-    PostMethod post = httpPost("/notebook/", jsonRequest, user, pwd);
+    CloseableHttpResponse post = httpPost("/notebook/", jsonRequest, user, pwd);
     assertThat("test note create method:", post, isAllowed());
     Map<String, Object> resp =
         gson.fromJson(
-            post.getResponseBodyAsString(), new TypeToken<Map<String, Object>>() {}.getType());
-    post.releaseConnection();
+          EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8), new TypeToken<Map<String, Object>>() {}.getType());
+    post.close();
     String newNoteId = (String) resp.get("body");
     Notebook notebook = TestUtils.getInstance(Notebook.class);
     Note newNote = notebook.getNote(newNoteId);
@@ -149,9 +148,9 @@ public class NotebookSecurityRestApiTest extends AbstractTestRestApi {
   }
 
   private void deleteNoteForUser(String noteId, String user, String pwd) throws IOException {
-    DeleteMethod delete = httpDelete(("/notebook/" + noteId), user, pwd);
+    CloseableHttpResponse delete = httpDelete(("/notebook/" + noteId), user, pwd);
     assertThat("Test delete method:", delete, isAllowed());
-    delete.releaseConnection();
+    delete.close();
     // make sure note is deleted
     if (!noteId.isEmpty()) {
       Note deletedNote = TestUtils.getInstance(Notebook.class).getNote(noteId);
@@ -162,14 +161,14 @@ public class NotebookSecurityRestApiTest extends AbstractTestRestApi {
   private void createParagraphForUser(String noteId, String user, String pwd,
           String title, String text) throws IOException {
     String payload = "{\"title\": \"" + title + "\",\"text\": \"" + text + "\"}";
-    PostMethod post = httpPost(("/notebook/" + noteId + "/paragraph"), payload, user, pwd);
-    post.releaseConnection();
+    CloseableHttpResponse post = httpPost(("/notebook/" + noteId + "/paragraph"), payload, user, pwd);
+    post.close();
   }
 
   private void setPermissionForNote(String noteId, String user, String pwd) throws IOException {
     String payload = "{\"owners\":[\"" + user + "\"],\"readers\":[\"" + user +
             "\"],\"runners\":[\"" + user + "\"],\"writers\":[\"" + user + "\"]}";
-    PutMethod put = httpPut(("/notebook/" + noteId + "/permissions"), payload, user, pwd);
-    put.releaseConnection();
+    CloseableHttpResponse put = httpPut(("/notebook/" + noteId + "/permissions"), payload, user, pwd);
+    put.close();
   }
 }
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/SecurityRestApiTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/SecurityRestApiTest.java
index c4584b2..2fb4988 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/SecurityRestApiTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/SecurityRestApiTest.java
@@ -19,7 +19,8 @@ package org.apache.zeppelin.rest;
 import com.google.gson.Gson;
 import com.google.gson.reflect.TypeToken;
 
-import org.apache.commons.httpclient.methods.GetMethod;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
 import org.hamcrest.CoreMatchers;
 import org.junit.AfterClass;
 import org.junit.BeforeClass;
@@ -28,6 +29,7 @@ import org.junit.Test;
 import org.junit.rules.ErrorCollector;
 
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.List;
 import java.util.Map;
 
@@ -49,51 +51,48 @@ public class SecurityRestApiTest extends AbstractTestRestApi {
 
   @Test
   public void testTicket() throws IOException {
-    GetMethod get = httpGet("/security/ticket", "admin", "password1");
-    get.addRequestHeader("Origin", "http://localhost");
-    Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+    CloseableHttpResponse get = httpGet("/security/ticket", "admin", "password1");
+    Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
         new TypeToken<Map<String, Object>>(){}.getType());
     Map<String, String> body = (Map<String, String>) resp.get("body");
     collector.checkThat("Paramater principal", body.get("principal"),
         CoreMatchers.equalTo("admin"));
     collector.checkThat("Paramater ticket", body.get("ticket"),
         CoreMatchers.not("anonymous"));
-    get.releaseConnection();
+    get.close();
   }
 
   @Test
   public void testGetUserList() throws IOException {
-    GetMethod get = httpGet("/security/userlist/admi", "admin", "password1");
-    get.addRequestHeader("Origin", "http://localhost");
-    Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+    CloseableHttpResponse get = httpGet("/security/userlist/admi", "admin", "password1");
+    Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
         new TypeToken<Map<String, Object>>(){}.getType());
     List<String> userList = (List) ((Map) resp.get("body")).get("users");
     collector.checkThat("Search result size", userList.size(),
         CoreMatchers.equalTo(1));
     collector.checkThat("Search result contains admin", userList.contains("admin"),
         CoreMatchers.equalTo(true));
-    get.releaseConnection();
+    get.close();
 
-    GetMethod notUser = httpGet("/security/userlist/randomString", "admin", "password1");
-    notUser.addRequestHeader("Origin", "http://localhost");
-    Map<String, Object> notUserResp = gson.fromJson(notUser.getResponseBodyAsString(),
+    CloseableHttpResponse notUser = httpGet("/security/userlist/randomString", "admin", "password1");
+    Map<String, Object> notUserResp = gson.fromJson(EntityUtils.toString(notUser.getEntity(), StandardCharsets.UTF_8),
         new TypeToken<Map<String, Object>>(){}.getType());
     List<String> emptyUserList = (List) ((Map) notUserResp.get("body")).get("users");
     collector.checkThat("Search result size", emptyUserList.size(),
         CoreMatchers.equalTo(0));
 
-    notUser.releaseConnection();
+    notUser.close();
   }
 
   @Test
   public void testRolesEscaped() throws IOException {
-    GetMethod get = httpGet("/security/ticket", "admin", "password1");
-    Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+    CloseableHttpResponse get = httpGet("/security/ticket", "admin", "password1");
+    Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>(){}.getType());
     String roles = (String) ((Map) resp.get("body")).get("roles");
     collector.checkThat("Paramater roles", roles,
             CoreMatchers.equalTo("[\"admin\"]"));
-    get.releaseConnection();
+    get.close();
   }
 
 }
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/ZeppelinRestApiTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/ZeppelinRestApiTest.java
index 96ef8ee..073fe21 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/rest/ZeppelinRestApiTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/rest/ZeppelinRestApiTest.java
@@ -27,11 +27,9 @@ import com.google.common.collect.Sets;
 import com.google.gson.Gson;
 import com.google.gson.reflect.TypeToken;
 
-import org.apache.commons.httpclient.methods.DeleteMethod;
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.httpclient.methods.PostMethod;
-import org.apache.commons.httpclient.methods.PutMethod;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.util.EntityUtils;
 import org.apache.zeppelin.notebook.AuthorizationService;
 import org.apache.zeppelin.notebook.Notebook;
 import org.apache.zeppelin.rest.message.NoteJobStatus;
@@ -45,6 +43,7 @@ import org.junit.Test;
 import org.junit.runners.MethodSorters;
 
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -86,10 +85,10 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
   @Test
   public void getApiRoot() throws IOException {
     // when
-    GetMethod httpGetRoot = httpGet("/");
+    CloseableHttpResponse httpGetRoot = httpGet("/");
     // then
     assertThat(httpGetRoot, isAllowed());
-    httpGetRoot.releaseConnection();
+    httpGetRoot.close();
   }
 
   @Test
@@ -102,7 +101,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       assertNotNull("can't create new note", note);
       note.setName("note");
       Paragraph paragraph = note.addNewParagraph(AuthenticationInfo.ANONYMOUS);
-      Map config = paragraph.getConfig();
+      Map<String, Object> config = paragraph.getConfig();
       config.put("enabled", true);
       paragraph.setConfig(config);
       String paragraphText = "%md This is my new paragraph in my new note";
@@ -110,11 +109,12 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       TestUtils.getInstance(Notebook.class).saveNote(note, anonymous);
 
       String sourceNoteId = note.getId();
-      GetMethod get = httpGet("/notebook/" + sourceNoteId);
-      LOG.info("testGetNoteInfo \n" + get.getResponseBodyAsString());
+      CloseableHttpResponse get = httpGet("/notebook/" + sourceNoteId);
+      String getResponse = EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8);
+      LOG.info("testGetNoteInfo \n" + getResponse);
       assertThat("test note get method:", get, isAllowed());
 
-      Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(getResponse,
               new TypeToken<Map<String, Object>>() {}.getType());
 
       assertNotNull(resp);
@@ -125,6 +125,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
 
       assertTrue(paragraphs.size() > 0);
       assertEquals(paragraphText, paragraphs.get(0).get("text"));
+      get.close();
     } finally {
       if (null != note) {
         TestUtils.getInstance(Notebook.class).removeNote(note, anonymous);
@@ -154,11 +155,12 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
         "\"config\": {\"colWidth\": 9.0, \"title\": true, " +
         "\"results\": [{\"graph\": {\"mode\": \"pieChart\"}}] " +
         "}}]} ";
-    PostMethod post = httpPost("/notebook/", jsonRequest);
-    LOG.info("testNoteCreate \n" + post.getResponseBodyAsString());
+    CloseableHttpResponse post = httpPost("/notebook/", jsonRequest);
+    String postResponse = EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8);
+    LOG.info("testNoteCreate \n" + postResponse);
     assertThat("test note create method:", post, isAllowed());
 
-    Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+    Map<String, Object> resp = gson.fromJson(postResponse,
             new TypeToken<Map<String, Object>>() {}.getType());
 
     String newNoteId =  (String) resp.get("body");
@@ -190,17 +192,18 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
     }
     // cleanup
     TestUtils.getInstance(Notebook.class).removeNote(newNote, anonymous);
-    post.releaseConnection();
+    post.close();
   }
 
   private void testNoteCreate(String noteName) throws IOException {
     // Call Create Note REST API
     String jsonRequest = "{\"name\":\"" + noteName + "\"}";
-    PostMethod post = httpPost("/notebook/", jsonRequest);
-    LOG.info("testNoteCreate \n" + post.getResponseBodyAsString());
+    CloseableHttpResponse post = httpPost("/notebook/", jsonRequest);
+    String postResponse = EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8);
+    LOG.info("testNoteCreate \n" + postResponse);
     assertThat("test note create method:", post, isAllowed());
 
-    Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+    Map<String, Object> resp = gson.fromJson(postResponse,
             new TypeToken<Map<String, Object>>() {}.getType());
 
     String newNoteId =  (String) resp.get("body");
@@ -216,7 +219,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
     assertEquals("compare note name", noteName, newNoteName);
     // cleanup
     TestUtils.getInstance(Notebook.class).removeNote(newNote, anonymous);
-    post.releaseConnection();
+    post.close();
   }
 
   @Test
@@ -253,25 +256,26 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       assertNotNull("can't create new note", note);
       note.setName("source note for export");
       Paragraph paragraph = note.addNewParagraph(AuthenticationInfo.ANONYMOUS);
-      Map config = paragraph.getConfig();
+      Map<String, Object> config = paragraph.getConfig();
       config.put("enabled", true);
       paragraph.setConfig(config);
       paragraph.setText("%md This is my new paragraph in my new note");
       TestUtils.getInstance(Notebook.class).saveNote(note, anonymous);
       String sourceNoteId = note.getId();
       // Call export Note REST API
-      GetMethod get = httpGet("/notebook/export/" + sourceNoteId);
-      LOG.info("testNoteExport \n" + get.getResponseBodyAsString());
+      CloseableHttpResponse get = httpGet("/notebook/export/" + sourceNoteId);
+      String getResponse = EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8);
+      LOG.info("testNoteExport \n" + getResponse);
       assertThat("test note export method:", get, isAllowed());
 
       Map<String, Object> resp =
-          gson.fromJson(get.getResponseBodyAsString(),
+          gson.fromJson(getResponse,
               new TypeToken<Map<String, Object>>() {}.getType());
 
       String exportJSON = (String) resp.get("body");
       assertNotNull("Can not find new notejson", exportJSON);
       LOG.info("export JSON:=" + exportJSON);
-      get.releaseConnection();
+      get.close();
     } finally {
       if (null != note) {
         TestUtils.getInstance(Notebook.class).removeNote(note, anonymous);
@@ -294,7 +298,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       assertNotNull("can't create new note", note);
       note.setName(noteName);
       Paragraph paragraph = note.addNewParagraph(AuthenticationInfo.ANONYMOUS);
-      Map config = paragraph.getConfig();
+      Map<String, Object> config = paragraph.getConfig();
       config.put("enabled", true);
       paragraph.setConfig(config);
       paragraph.setText("%md This is my new paragraph in my new note");
@@ -306,10 +310,10 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       TestUtils.getInstance(Notebook.class).removeNote(note, anonymous);
 
       // call note post
-      PostMethod importPost = httpPost("/notebook/import/", oldJson);
+      CloseableHttpResponse importPost = httpPost("/notebook/import/", oldJson);
       assertThat(importPost, isAllowed());
       resp =
-          gson.fromJson(importPost.getResponseBodyAsString(),
+          gson.fromJson(EntityUtils.toString(importPost.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
       String importId = (String) resp.get("body");
 
@@ -318,7 +322,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       assertEquals("Compare note names", noteName, newNote.getName());
       assertEquals("Compare paragraphs count", note.getParagraphs().size(), newNote.getParagraphs()
           .size());
-      importPost.releaseConnection();
+      importPost.close();
     } finally {
       if (null != note) {
         if (TestUtils.getInstance(Notebook.class).getNote(note.getId()) != null) {
@@ -334,24 +338,23 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
   }
 
   private String getNoteContent(String id) throws IOException {
-    GetMethod get = httpGet("/notebook/export/" + id);
+    CloseableHttpResponse get = httpGet("/notebook/export/" + id);
     assertThat(get, isAllowed());
-    get.addRequestHeader("Origin", "http://localhost");
     Map<String, Object> resp =
-        gson.fromJson(get.getResponseBodyAsString(),
+        gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() {}.getType());
-    assertEquals(200, get.getStatusCode());
+    assertEquals(200, get.getStatusLine().getStatusCode());
     String body = resp.get("body").toString();
     // System.out.println("Body is " + body);
-    get.releaseConnection();
+    get.close();
     return body;
   }
 
   private void testDeleteNote(String noteId) throws IOException {
-    DeleteMethod delete = httpDelete(("/notebook/" + noteId));
-    LOG.info("testDeleteNote delete response\n" + delete.getResponseBodyAsString());
+    CloseableHttpResponse delete = httpDelete(("/notebook/" + noteId));
+    LOG.info("testDeleteNote delete response\n" + EntityUtils.toString(delete.getEntity(), StandardCharsets.UTF_8));
     assertThat("Test delete method:", delete, isAllowed());
-    delete.releaseConnection();
+    delete.close();
     // make sure note is deleted
     if (!noteId.isEmpty()) {
       Note deletedNote = TestUtils.getInstance(Notebook.class).getNote(noteId);
@@ -360,10 +363,10 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
   }
 
   private void testDeleteNotExistNote(String noteId) throws IOException {
-    DeleteMethod delete = httpDelete(("/notebook/" + noteId));
-    LOG.info("testDeleteNote delete response\n" + delete.getResponseBodyAsString());
+    CloseableHttpResponse delete = httpDelete(("/notebook/" + noteId));
+    LOG.info("testDeleteNote delete response\n" + EntityUtils.toString(delete.getEntity(), StandardCharsets.UTF_8));
     assertThat("Test delete method:", delete, isNotFound());
-    delete.releaseConnection();
+    delete.close();
   }
 
   @Test
@@ -376,7 +379,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       assertNotNull("can't create new note", note);
       note.setName("source note for clone");
       Paragraph paragraph = note.addNewParagraph(AuthenticationInfo.ANONYMOUS);
-      Map config = paragraph.getConfig();
+      Map<String, Object> config = paragraph.getConfig();
       config.put("enabled", true);
       paragraph.setConfig(config);
       paragraph.setText("%md This is my new paragraph in my new note");
@@ -386,11 +389,12 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       String noteName = "clone Note Name";
       // Call Clone Note REST API
       String jsonRequest = "{\"name\":\"" + noteName + "\"}";
-      PostMethod post = httpPost("/notebook/" + sourceNoteId, jsonRequest);
-      LOG.info("testNoteClone \n" + post.getResponseBodyAsString());
+      CloseableHttpResponse post = httpPost("/notebook/" + sourceNoteId, jsonRequest);
+      String postResponse = EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8);
+      LOG.info("testNoteClone \n" + postResponse);
       assertThat("test note clone method:", post, isAllowed());
 
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(postResponse,
               new TypeToken<Map<String, Object>>() {}.getType());
 
       String newNoteId =  (String) resp.get("body");
@@ -400,7 +404,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       assertEquals("Compare note names", noteName, newNote.getName());
       assertEquals("Compare paragraphs count", note.getParagraphs().size(),
               newNote.getParagraphs().size());
-      post.releaseConnection();
+      post.close();
     } finally {
       //cleanup
       if (null != note) {
@@ -415,9 +419,9 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
   @Test
   public void testListNotes() throws IOException {
     LOG.info("testListNotes");
-    GetMethod get = httpGet("/notebook/ ");
+    CloseableHttpResponse get = httpGet("/notebook/");
     assertThat("List notes method", get, isAllowed());
-    Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+    Map<String, Object> resp = gson.fromJson(EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8),
             new TypeToken<Map<String, Object>>() {}.getType());
     List<Map<String, String>> body = (List<Map<String, String>>) resp.get("body");
     //TODO(khalid): anonymous or specific user notes?
@@ -426,7 +430,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
     assertEquals("List notes are equal", TestUtils.getInstance(Notebook.class)
             .getAllNotes(note -> authorizationService.isReader(note.getId(), anonymous))
             .size(), body.size());
-    get.releaseConnection();
+    get.close();
   }
 
   @Test
@@ -441,7 +445,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       note.setName("note for run test");
       Paragraph paragraph = note.addNewParagraph(AuthenticationInfo.ANONYMOUS);
 
-      Map config = paragraph.getConfig();
+      Map<String, Object> config = paragraph.getConfig();
       config.put("enabled", true);
       paragraph.setConfig(config);
 
@@ -461,26 +465,26 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       }
 
       // Call Run note jobs REST API
-      PostMethod postNoteJobs = httpPost("/notebook/job/" + noteId + "?blocking=true", "");
+      CloseableHttpResponse postNoteJobs = httpPost("/notebook/job/" + noteId + "?blocking=true", "");
       assertThat("test note jobs run:", postNoteJobs, isAllowed());
-      postNoteJobs.releaseConnection();
+      postNoteJobs.close();
 
       // Call Stop note jobs REST API
-      DeleteMethod deleteNoteJobs = httpDelete("/notebook/job/" + noteId);
+      CloseableHttpResponse deleteNoteJobs = httpDelete("/notebook/job/" + noteId);
       assertThat("test note stop:", deleteNoteJobs, isAllowed());
-      deleteNoteJobs.releaseConnection();
+      deleteNoteJobs.close();
       Thread.sleep(1000);
 
       // Call Run paragraph REST API
-      PostMethod postParagraph = httpPost("/notebook/job/" + noteId + "/" + paragraph.getId(), "");
+      CloseableHttpResponse postParagraph = httpPost("/notebook/job/" + noteId + "/" + paragraph.getId(), "");
       assertThat("test paragraph run:", postParagraph, isAllowed());
-      postParagraph.releaseConnection();
+      postParagraph.close();
       Thread.sleep(1000);
 
       // Call Stop paragraph REST API
-      DeleteMethod deleteParagraph = httpDelete("/notebook/job/" + noteId + "/" + paragraph.getId());
+      CloseableHttpResponse deleteParagraph = httpDelete("/notebook/job/" + noteId + "/" + paragraph.getId());
       assertThat("test paragraph stop:", deleteParagraph, isAllowed());
-      deleteParagraph.releaseConnection();
+      deleteParagraph.close();
       Thread.sleep(1000);
     } finally {
       //cleanup
@@ -502,7 +506,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       note.setName("note for run test");
       Paragraph paragraph = note.addNewParagraph(AuthenticationInfo.ANONYMOUS);
 
-      Map config = paragraph.getConfig();
+      Map<String, Object> config = paragraph.getConfig();
       config.put("enabled", true);
       paragraph.setConfig(config);
 
@@ -513,10 +517,10 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
 
       note.runAll(anonymous, true, false, new HashMap<>());
       // assume that status of the paragraph is running
-      GetMethod get = httpGet("/notebook/job/" + noteId);
+      CloseableHttpResponse get = httpGet("/notebook/job/" + noteId);
       assertThat("test get note job: ", get, isAllowed());
-      String responseBody = get.getResponseBodyAsString();
-      get.releaseConnection();
+      String responseBody = EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8);
+      get.close();
 
       LOG.info("test get note job: \n" + responseBody);
       Map<String, Object> resp = gson.fromJson(responseBody,
@@ -556,7 +560,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       note.setName("note for run test");
       Paragraph paragraph = note.addNewParagraph(AuthenticationInfo.ANONYMOUS);
 
-      Map config = paragraph.getConfig();
+      Map<String, Object> config = paragraph.getConfig();
       config.put("enabled", true);
       paragraph.setConfig(config);
 
@@ -567,10 +571,10 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       note.runAll(anonymous, true, false, new HashMap<>());
 
       // Call Run paragraph REST API
-      PostMethod postParagraph = httpPost("/notebook/job/" + noteId + "/" + paragraph.getId(),
+      CloseableHttpResponse postParagraph = httpPost("/notebook/job/" + noteId + "/" + paragraph.getId(),
           "{\"params\": {\"param\": \"hello\", \"param2\": \"world\"}}");
       assertThat("test paragraph run:", postParagraph, isAllowed());
-      postParagraph.releaseConnection();
+      postParagraph.close();
       Thread.sleep(1000);
 
       Note retrNote = TestUtils.getInstance(Notebook.class).getNote(noteId);
@@ -598,7 +602,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       Paragraph paragraph = note.addNewParagraph(AuthenticationInfo.ANONYMOUS);
       paragraph.setText("%md This is test paragraph.");
 
-      Map config = paragraph.getConfig();
+      Map<String, Object> config = paragraph.getConfig();
       config.put("enabled", true);
       paragraph.setConfig(config);
 
@@ -606,27 +610,27 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
 
       String jsonRequest = "{\"cron\":\"* * * * * ?\" }";
       // right cron expression but not exist note.
-      PostMethod postCron = httpPost("/notebook/cron/notexistnote", jsonRequest);
+      CloseableHttpResponse postCron = httpPost("/notebook/cron/notexistnote", jsonRequest);
       assertThat("", postCron, isNotFound());
-      postCron.releaseConnection();
+      postCron.close();
 
       // right cron expression.
       postCron = httpPost("/notebook/cron/" + note.getId(), jsonRequest);
       assertThat("", postCron, isAllowed());
-      postCron.releaseConnection();
+      postCron.close();
       Thread.sleep(1000);
 
       // wrong cron expression.
       jsonRequest = "{\"cron\":\"a * * * * ?\" }";
       postCron = httpPost("/notebook/cron/" + note.getId(), jsonRequest);
       assertThat("", postCron, isBadRequest());
-      postCron.releaseConnection();
+      postCron.close();
       Thread.sleep(1000);
 
       // remove cron job.
-      DeleteMethod deleteCron = httpDelete("/notebook/cron/" + note.getId());
+      CloseableHttpResponse deleteCron = httpDelete("/notebook/cron/" + note.getId());
       assertThat("", deleteCron, isAllowed());
-      deleteCron.releaseConnection();
+      deleteCron.close();
     } finally {
       //cleanup
       if (null != note) {
@@ -648,7 +652,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       Paragraph paragraph = note.addNewParagraph(AuthenticationInfo.ANONYMOUS);
       paragraph.setText("%md This is test paragraph.");
 
-      Map config = paragraph.getConfig();
+      Map<String, Object> config = paragraph.getConfig();
       config.put("enabled", true);
       paragraph.setConfig(config);
 
@@ -656,9 +660,9 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
 
       String jsonRequest = "{\"cron\":\"* * * * * ?\" }";
       // right cron expression.
-      PostMethod postCron = httpPost("/notebook/cron/" + note.getId(), jsonRequest);
+      CloseableHttpResponse postCron = httpPost("/notebook/cron/" + note.getId(), jsonRequest);
       assertThat("", postCron, isForbidden());
-      postCron.releaseConnection();
+      postCron.close();
 
       System.setProperty(ConfVars.ZEPPELIN_NOTEBOOK_CRON_ENABLE.getVarName(), "true");
       System.setProperty(ConfVars.ZEPPELIN_NOTEBOOK_CRON_FOLDERS.getVarName(), "/System");
@@ -667,13 +671,13 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       note.runAll(AuthenticationInfo.ANONYMOUS, true, true, new HashMap<>());
       postCron = httpPost("/notebook/cron/" + note.getId(), jsonRequest);
       assertThat("", postCron, isAllowed());
-      postCron.releaseConnection();
+      postCron.close();
       Thread.sleep(1000);
 
       // remove cron job.
-      DeleteMethod deleteCron = httpDelete("/notebook/cron/" + note.getId());
+      CloseableHttpResponse deleteCron = httpDelete("/notebook/cron/" + note.getId());
       assertThat("", deleteCron, isAllowed());
-      deleteCron.releaseConnection();
+      deleteCron.close();
       Thread.sleep(1000);
 
       System.clearProperty(ConfVars.ZEPPELIN_NOTEBOOK_CRON_FOLDERS.getVarName());
@@ -698,14 +702,14 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       note.runAll(AuthenticationInfo.ANONYMOUS, true, false, new HashMap<>());
       TestUtils.getInstance(Notebook.class).saveNote(note, anonymous);
 
-      GetMethod getNoteJobs = httpGet("/notebook/job/" + note.getId());
+      CloseableHttpResponse getNoteJobs = httpGet("/notebook/job/" + note.getId());
       assertThat("test note jobs run:", getNoteJobs, isAllowed());
-      Map<String, Object> resp = gson.fromJson(getNoteJobs.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(getNoteJobs.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
       NoteJobStatus noteJobStatus = NoteJobStatus.fromJson(gson.toJson(resp.get("body")));
       assertNotNull(noteJobStatus.getParagraphJobStatusList().get(0).getStarted());
       assertNotNull(noteJobStatus.getParagraphJobStatusList().get(0).getFinished());
-      getNoteJobs.releaseConnection();
+      getNoteJobs.close();
     } finally {
       //cleanup
       if (null != note) {
@@ -721,12 +725,13 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       note = TestUtils.getInstance(Notebook.class).createNote("note1_testInsertParagraph", anonymous);
 
       String jsonRequest = "{\"title\": \"title1\", \"text\": \"text1\"}";
-      PostMethod post = httpPost("/notebook/" + note.getId() + "/paragraph", jsonRequest);
-      LOG.info("testInsertParagraph response\n" + post.getResponseBodyAsString());
+      CloseableHttpResponse post = httpPost("/notebook/" + note.getId() + "/paragraph", jsonRequest);
+      String postResponse = EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8);
+      LOG.info("testInsertParagraph response\n" + postResponse);
       assertThat("Test insert method:", post, isAllowed());
-      post.releaseConnection();
+      post.close();
 
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(postResponse,
               new TypeToken<Map<String, Object>>() {}.getType());
 
       String newParagraphId = (String) resp.get("body");
@@ -744,10 +749,10 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
 
       // insert to index 0
       String jsonRequest2 = "{\"index\": 0, \"title\": \"title2\", \"text\": \"text2\"}";
-      PostMethod post2 = httpPost("/notebook/" + note.getId() + "/paragraph", jsonRequest2);
-      LOG.info("testInsertParagraph response2\n" + post2.getResponseBodyAsString());
+      CloseableHttpResponse post2 = httpPost("/notebook/" + note.getId() + "/paragraph", jsonRequest2);
+      LOG.info("testInsertParagraph response2\n" + EntityUtils.toString(post2.getEntity(), StandardCharsets.UTF_8));
       assertThat("Test insert method:", post2, isAllowed());
-      post2.releaseConnection();
+      post2.close();
 
       Paragraph paragraphAtIdx0 = note.getParagraphs().get(0);
       assertEquals("title2", paragraphAtIdx0.getTitle());
@@ -757,10 +762,10 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       String jsonRequest3 = "{\"title\": \"title3\", \"text\": \"text3\", " +
                             "\"config\": {\"colWidth\": 9.0, \"title\": true, " +
                             "\"results\": [{\"graph\": {\"mode\": \"pieChart\"}}]}}";
-      PostMethod post3 = httpPost("/notebook/" + note.getId() + "/paragraph", jsonRequest3);
-      LOG.info("testInsertParagraph response4\n" + post3.getResponseBodyAsString());
+      CloseableHttpResponse post3 = httpPost("/notebook/" + note.getId() + "/paragraph", jsonRequest3);
+      LOG.info("testInsertParagraph response4\n" + EntityUtils.toString(post3.getEntity(), StandardCharsets.UTF_8));
       assertThat("Test insert method:", post3, isAllowed());
-      post3.releaseConnection();
+      post3.close();
 
       Paragraph p = note.getLastParagraph();
       assertEquals("title3", p.getTitle());
@@ -785,10 +790,10 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       note = TestUtils.getInstance(Notebook.class).createNote("note1_testUpdateParagraph", anonymous);
 
       String jsonRequest = "{\"title\": \"title1\", \"text\": \"text1\"}";
-      PostMethod post = httpPost("/notebook/" + note.getId() + "/paragraph", jsonRequest);
-      Map<String, Object> resp = gson.fromJson(post.getResponseBodyAsString(),
+      CloseableHttpResponse post = httpPost("/notebook/" + note.getId() + "/paragraph", jsonRequest);
+      Map<String, Object> resp = gson.fromJson(EntityUtils.toString(post.getEntity(), StandardCharsets.UTF_8),
               new TypeToken<Map<String, Object>>() {}.getType());
-      post.releaseConnection();
+      post.close();
 
       String newParagraphId = (String) resp.get("body");
       Paragraph newParagraph = TestUtils.getInstance(Notebook.class).getNote(note.getId())
@@ -798,10 +803,10 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       assertEquals("text1", newParagraph.getText());
 
       String updateRequest = "{\"text\": \"updated text\"}";
-      PutMethod put = httpPut("/notebook/" + note.getId() + "/paragraph/" + newParagraphId,
+      CloseableHttpResponse put = httpPut("/notebook/" + note.getId() + "/paragraph/" + newParagraphId,
               updateRequest);
       assertThat("Test update method:", put, isAllowed());
-      put.releaseConnection();
+      put.close();
 
       Paragraph updatedParagraph = TestUtils.getInstance(Notebook.class).getNote(note.getId())
               .getParagraph(newParagraphId);
@@ -810,9 +815,9 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       assertEquals("updated text", updatedParagraph.getText());
 
       String updateBothRequest = "{\"title\": \"updated title\", \"text\" : \"updated text 2\" }";
-      PutMethod updatePut = httpPut("/notebook/" + note.getId() + "/paragraph/" + newParagraphId,
+      CloseableHttpResponse updatePut = httpPut("/notebook/" + note.getId() + "/paragraph/" + newParagraphId,
               updateBothRequest);
-      updatePut.releaseConnection();
+      updatePut.close();
 
       Paragraph updatedBothParagraph = TestUtils.getInstance(Notebook.class).getNote(note.getId())
               .getParagraph(newParagraphId);
@@ -838,12 +843,13 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       p.setText("world");
       TestUtils.getInstance(Notebook.class).saveNote(note, anonymous);
 
-      GetMethod get = httpGet("/notebook/" + note.getId() + "/paragraph/" + p.getId());
-      LOG.info("testGetParagraph response\n" + get.getResponseBodyAsString());
+      CloseableHttpResponse get = httpGet("/notebook/" + note.getId() + "/paragraph/" + p.getId());
+      String getResponse = EntityUtils.toString(get.getEntity(), StandardCharsets.UTF_8);
+      LOG.info("testGetParagraph response\n" + getResponse);
       assertThat("Test get method: ", get, isAllowed());
-      get.releaseConnection();
+      get.close();
 
-      Map<String, Object> resp = gson.fromJson(get.getResponseBodyAsString(),
+      Map<String, Object> resp = gson.fromJson(getResponse,
               new TypeToken<Map<String, Object>>() {}.getType());
 
       assertNotNull(resp);
@@ -878,10 +884,10 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
 
       TestUtils.getInstance(Notebook.class).saveNote(note, anonymous);
 
-      PostMethod post = httpPost("/notebook/" + note.getId() + "/paragraph/" + p2.getId() +
+      CloseableHttpResponse post = httpPost("/notebook/" + note.getId() + "/paragraph/" + p2.getId() +
               "/move/" + 0, "");
       assertThat("Test post method: ", post, isAllowed());
-      post.releaseConnection();
+      post.close();
 
       Note retrNote = TestUtils.getInstance(Notebook.class).getNote(note.getId());
       Paragraph paragraphAtIdx0 = retrNote.getParagraphs().get(0);
@@ -890,10 +896,10 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
       assertEquals(p2.getTitle(), paragraphAtIdx0.getTitle());
       assertEquals(p2.getText(), paragraphAtIdx0.getText());
 
-      PostMethod post2 = httpPost("/notebook/" + note.getId() + "/paragraph/" + p2.getId() +
+      CloseableHttpResponse post2 = httpPost("/notebook/" + note.getId() + "/paragraph/" + p2.getId() +
               "/move/" + 10, "");
       assertThat("Test post method: ", post2, isBadRequest());
-      post.releaseConnection();
+      post.close();
     } finally {
       //cleanup
       if (null != note) {
@@ -914,9 +920,9 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
 
       TestUtils.getInstance(Notebook.class).saveNote(note, anonymous);
 
-      DeleteMethod delete = httpDelete("/notebook/" + note.getId() + "/paragraph/" + p.getId());
+      CloseableHttpResponse delete = httpDelete("/notebook/" + note.getId() + "/paragraph/" + p.getId());
       assertThat("Test delete method: ", delete, isAllowed());
-      delete.releaseConnection();
+      delete.close();
 
       Note retrNote = TestUtils.getInstance(Notebook.class).getNote(note.getId());
       Paragraph retrParagrah = retrNote.getParagraph(p.getId());
@@ -929,21 +935,19 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
     }
   }
 
-  // TODO(zjffdu) disable it as it fails, need to investigate why.
-  //@Test
+  @Test
   public void testTitleSearch() throws IOException, InterruptedException {
     Note note = null;
     try {
       note = TestUtils.getInstance(Notebook.class).createNote("note1_testTitleSearch", anonymous);
       String jsonRequest = "{\"title\": \"testTitleSearchOfParagraph\", " +
               "\"text\": \"ThisIsToTestSearchMethodWithTitle \"}";
-      PostMethod postNoteText = httpPost("/notebook/" + note.getId() + "/paragraph", jsonRequest);
-      postNoteText.releaseConnection();
+      CloseableHttpResponse postNoteText = httpPost("/notebook/" + note.getId() + "/paragraph", jsonRequest);
+      postNoteText.close();
       Thread.sleep(1000);
 
-      GetMethod searchNote = httpGet("/notebook/search?q='testTitleSearchOfParagraph'");
-      searchNote.addRequestHeader("Origin", "http://localhost");
-      Map<String, Object> respSearchResult = gson.fromJson(searchNote.getResponseBodyAsString(),
+      CloseableHttpResponse searchNote = httpGet("/notebook/search?q='testTitleSearchOfParagraph'");
+      Map<String, Object> respSearchResult = gson.fromJson(EntityUtils.toString(searchNote.getEntity(), StandardCharsets.UTF_8),
           new TypeToken<Map<String, Object>>() {
           }.getType());
       ArrayList searchBody = (ArrayList) respSearchResult.get("body");
@@ -956,7 +960,7 @@ public class ZeppelinRestApiTest extends AbstractTestRestApi {
         }
       }
       assertEquals("Paragraph title hits must be at-least one", true, numberOfTitleHits >= 1);
-      searchNote.releaseConnection();
+      searchNote.close();
     } finally {
       //cleanup
       if (null != note) {
diff --git a/zeppelin-server/src/test/java/org/apache/zeppelin/security/DirAccessTest.java b/zeppelin-server/src/test/java/org/apache/zeppelin/security/DirAccessTest.java
index d70f37d..27414a9 100644
--- a/zeppelin-server/src/test/java/org/apache/zeppelin/security/DirAccessTest.java
+++ b/zeppelin-server/src/test/java/org/apache/zeppelin/security/DirAccessTest.java
@@ -16,16 +16,18 @@
  */
 package org.apache.zeppelin.security;
 
-import org.apache.commons.httpclient.HttpClient;
-import org.apache.commons.httpclient.HttpStatus;
-import org.apache.commons.httpclient.methods.GetMethod;
 import org.junit.Test;
-
+import org.apache.http.HttpStatus;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.util.EntityUtils;
 import org.apache.zeppelin.conf.ZeppelinConfiguration;
 import org.apache.zeppelin.rest.AbstractTestRestApi;
 
 import static org.junit.Assert.assertEquals;
 
+import java.nio.charset.StandardCharsets;
+
 public class DirAccessTest extends AbstractTestRestApi {
   @Test
   public void testDirAccessForbidden() throws Exception {
@@ -34,12 +36,10 @@ public class DirAccessTest extends AbstractTestRestApi {
         System.setProperty(ZeppelinConfiguration.ConfVars.ZEPPELIN_SERVER_DEFAULT_DIR_ALLOWED
                 .getVarName(), "false");
         AbstractTestRestApi.startUp(DirAccessTest.class.getSimpleName());
-        HttpClient httpClient = new HttpClient();
-        GetMethod getMethod = new GetMethod(getUrlToTest() + "/app/");
-        LOG.info("Invoke getMethod");
-        httpClient.executeMethod(getMethod);
-        assertEquals(getMethod.getResponseBodyAsString(),
-                HttpStatus.SC_FORBIDDEN, getMethod.getStatusCode());
+        CloseableHttpResponse getMethod = getHttpClient().execute(new HttpGet(getUrlToTest() + "/app/"));
+        LOG.info("Invoke getMethod - " + EntityUtils.toString(getMethod.getEntity(), StandardCharsets.UTF_8));
+
+        assertEquals(HttpStatus.SC_FORBIDDEN, getMethod.getStatusLine().getStatusCode());
       } finally {
         AbstractTestRestApi.shutDown();
       }
@@ -53,12 +53,9 @@ public class DirAccessTest extends AbstractTestRestApi {
         System.setProperty(ZeppelinConfiguration.ConfVars.ZEPPELIN_SERVER_DEFAULT_DIR_ALLOWED
                 .getVarName(), "true");
         AbstractTestRestApi.startUp(DirAccessTest.class.getSimpleName());
-        HttpClient httpClient = new HttpClient();
-        GetMethod getMethod = new GetMethod(getUrlToTest() + "/app/");
-        LOG.info("Invoke getMethod");
-        httpClient.executeMethod(getMethod);
-        assertEquals(getMethod.getResponseBodyAsString(),
-                HttpStatus.SC_OK, getMethod.getStatusCode());
+        CloseableHttpResponse getMethod = getHttpClient().execute(new HttpGet(getUrlToTest() + "/app/"));
+        LOG.info("Invoke getMethod - " + EntityUtils.toString(getMethod.getEntity(), StandardCharsets.UTF_8));
+        assertEquals(HttpStatus.SC_OK, getMethod.getStatusLine().getStatusCode());
       } finally {
         AbstractTestRestApi.shutDown();
       }
diff --git a/zeppelin-zengine/pom.xml b/zeppelin-zengine/pom.xml
index a046f63..34acc0a 100644
--- a/zeppelin-zengine/pom.xml
+++ b/zeppelin-zengine/pom.xml
@@ -100,6 +100,12 @@
     </dependency>
 
     <dependency>
+      <groupId>org.bouncycastle</groupId>
+      <artifactId>bcpkix-jdk15on</artifactId>
+    </dependency>
+
+
+    <dependency>
       <groupId>org.apache.jackrabbit</groupId>
       <artifactId>jackrabbit-webdav</artifactId>
       <version>${jackrabbit.webdav.version}</version>
diff --git a/zeppelin-zengine/src/main/java/org/apache/zeppelin/notebook/repo/zeppelinhub/security/Authentication.java b/zeppelin-zengine/src/main/java/org/apache/zeppelin/notebook/repo/zeppelinhub/security/Authentication.java
index 49e63a3..f579fe7 100644
--- a/zeppelin-zengine/src/main/java/org/apache/zeppelin/notebook/repo/zeppelinhub/security/Authentication.java
+++ b/zeppelin-zengine/src/main/java/org/apache/zeppelin/notebook/repo/zeppelinhub/security/Authentication.java
@@ -1,10 +1,11 @@
 package org.apache.zeppelin.notebook.repo.zeppelinhub.security;
 
 import java.io.IOException;
-import java.io.UnsupportedEncodingException;
+import java.nio.charset.StandardCharsets;
 import java.security.GeneralSecurityException;
 import java.security.Key;
 import java.security.SecureRandom;
+import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Map;
 
@@ -15,16 +16,18 @@ import javax.crypto.spec.IvParameterSpec;
 import javax.crypto.spec.SecretKeySpec;
 
 import org.apache.commons.codec.binary.Base64;
-import org.apache.commons.httpclient.HttpClient;
-import org.apache.commons.httpclient.HttpStatus;
-import org.apache.commons.httpclient.MultiThreadedHttpConnectionManager;
-import org.apache.commons.httpclient.NameValuePair;
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.httpclient.methods.PostMethod;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.http.HttpStatus;
+import org.apache.http.NameValuePair;
+import org.apache.http.client.entity.UrlEncodedFormEntity;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
+import org.apache.http.message.BasicNameValuePair;
+import org.apache.http.util.EntityUtils;
 import org.apache.zeppelin.conf.ZeppelinConfiguration;
-import org.apache.zeppelin.common.Message;
-import org.apache.zeppelin.common.Message.OP;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -41,13 +44,13 @@ public class Authentication implements Runnable {
   private String ticket = "anonymous";
   private String roles = StringUtils.EMPTY;
 
-  private final HttpClient client;
+  private final CloseableHttpClient client;
   private String loginEndpoint;
 
   // Cipher is an AES in CBC mode
   private static final String CIPHER_ALGORITHM = "AES";
   private static final String CIPHER_MODE = "AES/CBC/PKCS5PADDING";
-  private static final int ivSize = 16;
+  private static final int IV_SIZE = 16;
 
   private static final String ZEPPELINHUB_USER_KEY = "zeppelinhub.user.key";
   private String token;
@@ -70,8 +73,11 @@ public class Authentication implements Runnable {
   }
 
   private Authentication(String token, ZeppelinConfiguration conf) {
-    MultiThreadedHttpConnectionManager connectionManager = new MultiThreadedHttpConnectionManager();
-    client = new HttpClient(connectionManager);
+    PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager();
+    client = HttpClients.custom()
+    .setConnectionManager(cm)
+    .build();
+
     this.token = token;
 
     authEnabled = !conf.isAnonymousAllowed();
@@ -106,8 +112,7 @@ public class Authentication implements Runnable {
     if (conf.useSsl()) {
       scheme = "https";
     }
-    String endpoint = scheme + "://localhost:" + port + "/api/login";
-    return endpoint;
+    return scheme + "://localhost:" + port + "/api/login";
   }
 
   public boolean authenticate() {
@@ -140,7 +145,7 @@ public class Authentication implements Runnable {
     }
     //use hashed token as a salt
     String hashedToken = Integer.toString(token.hashCode());
-    return decrypt(userKey, hashedToken); 
+    return decrypt(userKey, hashedToken);
   }
 
   private String decrypt(String value, String initVector) {
@@ -155,7 +160,7 @@ public class Authentication implements Runnable {
       Cipher cipher = Cipher.getInstance(CIPHER_MODE);
       cipher.init(Cipher.DECRYPT_MODE, key, iv);
 
-      byte[] decryptedString = Base64.decodeBase64(toBytes(value));
+      byte[] decryptedString = Base64.decodeBase64(value.getBytes(StandardCharsets.UTF_8));
       decryptedString = cipher.doFinal(decryptedString);
       return new String(decryptedString);
     } catch (GeneralSecurityException e) {
@@ -170,20 +175,22 @@ public class Authentication implements Runnable {
     if (credentials.length != 2) {
       return Collections.emptyMap();
     }
-    PostMethod post = new PostMethod(endpoint);
-    post.addRequestHeader("Origin", "http://localhost");
-    post.addParameter(new NameValuePair("userName", credentials[0]));
-    post.addParameter(new NameValuePair("password", credentials[1]));
-    try {
-      int code = client.executeMethod(post);
-      if (code == HttpStatus.SC_OK) {
-        String content = post.getResponseBodyAsString();
-        Map<String, Object> resp = gson.fromJson(content, 
+    HttpPost post = new HttpPost(endpoint);
+    ArrayList<NameValuePair> postParameters = new ArrayList<>();
+    postParameters.add(new BasicNameValuePair("userName", credentials[0]));
+    postParameters.add(new BasicNameValuePair("password", credentials[1]));
+    post.setEntity(new UrlEncodedFormEntity(postParameters, StandardCharsets.UTF_8));
+    post.addHeader("Origin", "http://localhost");
+
+    try (CloseableHttpResponse postResponse = client.execute(post)) {
+      if (postResponse.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
+        String content = EntityUtils.toString(postResponse.getEntity(), StandardCharsets.UTF_8);
+        Map<String, Object> resp = gson.fromJson(content,
             new TypeToken<Map<String, Object>>() {}.getType());
-        LOG.info("Received from Zeppelin LoginRestApi : " + content);
+        LOG.info("Received from Zeppelin LoginRestApi : {}", content);
         return (Map<String, String>) resp.get("body");
       } else {
-        LOG.error("Failed Zeppelin login {}, status code {}", endpoint, code);
+        LOG.error("Failed Zeppelin login {}, status code {}", endpoint, postResponse);
         return Collections.emptyMap();
       }
     } catch (IOException e) {
@@ -205,21 +212,11 @@ public class Authentication implements Runnable {
     return null;
   }
 
-  private byte[] toBytes(String value) {
-    byte[] bytes;
-    try {
-      bytes = value.getBytes("UTF-8");
-    } catch (UnsupportedEncodingException e) {
-      LOG.warn("UTF-8 isn't supported ", e);
-      bytes = value.getBytes();
-    }
-    return bytes;
-  }
 
   private IvParameterSpec generateIV(String ivString) {
-    byte[] ivFromBytes = toBytes(ivString);
-    byte[] iv16ToBytes = new byte[ivSize];
-    System.arraycopy(ivFromBytes, 0, iv16ToBytes, 0, Math.min(ivFromBytes.length, ivSize));
+    byte[] ivFromBytes = ivString.getBytes(StandardCharsets.UTF_8);
+    byte[] iv16ToBytes = new byte[IV_SIZE];
+    System.arraycopy(ivFromBytes, 0, iv16ToBytes, 0, Math.min(ivFromBytes.length, IV_SIZE));
     return new IvParameterSpec(iv16ToBytes);
   }