[jira] [Commented] (HTTPCLIENT-2203) Credentials not sent when using preemptive auth

["Oleg Kalnichevski (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HTTPCLIENT-2203?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17490287#comment-17490287 ] 

Oleg Kalnichevski commented on HTTPCLIENT-2203:
-----------------------------------------------

[~SHowlett] What is broken is the port normalization in the request target, not the preemptive authentication as such. When executing the same code against {{http://httpbin.org:80/hidden-basic-auth/user/passwd}}, everything should work as expected.

> Note: Not sure why the response is 404 with this URL

This is likely because the target endpoint is hidden.

Oleg

> Credentials not sent when using preemptive auth
> -----------------------------------------------
>
>                 Key: HTTPCLIENT-2203
>                 URL: https://issues.apache.org/jira/browse/HTTPCLIENT-2203
>             Project: HttpComponents HttpClient
>          Issue Type: Bug
>    Affects Versions: 5.1.1, 5.1.2, 5.1.3
>            Reporter: S Howlett
>            Priority: Major
>             Fix For: 5.1.4, 5.2-alpha2
>
>
> After version 5.0.3, preemptive auth appears to be broken, with the {{Authorization}} header missing from requests sent. I wonder if this may be related to the fix for HTTPCLIENT-2147.
> I was able to reproduce this problem using the [Preemptive Authentication example|https://github.com/apache/httpcomponents-client/blob/5.1.x/httpclient5/src/test/java/org/apache/hc/client5/http/examples/ClientPreemptiveBasicAuthentication.java] provided in the [httpcomponents-client|https://github.com/apache/httpcomponents-client] GitHub repo. Below I outline the differences between the behaviour of HttpClient 5.0.3 and 5.1.1+ (using the Preemptive Authentication example, and Java 15.0.1). Nothing besides the HttpClient version was altered between the two cases.
> h2. *HttpClient 5.0.3*
> Preemptive Authentication example works as expected.
> Output:
> {code:java}
> Executing request GET http://httpbin.org/hidden-basic-auth/user/passwd
> ----------------------------------------
> 200 OK
> {
>   "authenticated": true, 
>   "user": "user"
> }
> ----------------------------------------
> 200 OK
> {
>   "authenticated": true, 
>   "user": "user"
> }
> ----------------------------------------
> 200 OK
> {
>   "authenticated": true, 
>   "user": "user"
> } {code}
> Debugging showed that, at [RedirectExec.java, line 118|https://github.com/apache/httpcomponents-client/blob/5.0.x/httpclient5/src/main/java/org/apache/hc/client5/http/impl/classic/RedirectExec.java#L118], {{currentRequest}} has 5 headers, including the {{Authorization}} header with Basic credentials. (Frames: RedirectExec.java, execute:118; ExecChainElement, execute:51; InternalHttpClient, doExecute:178; ClosableHttpClient, execute:75; ClientPreemptiveBasicAuthentication, main:66)
>  
> h2. *{color:#172b4d}HttpClient 5.1.1{color} and above*
> Credentials are not sent with requests in the Preemptive Authentication example.
> Output:
> {code:java}
> Executing request GET http://httpbin.org/hidden-basic-auth/user/passwd
> ----------------------------------------
> 404 NOT FOUND
> ----------------------------------------
> 404 NOT FOUND
> ----------------------------------------
> 404 NOT FOUND {code}
> Note: Not sure why the response is 404 with this URL; it is an authorisation issue and other URLs tend to return 403.
> Debugging showed that, at [RedirectExec.java, line 117|https://github.com/apache/httpcomponents-client/blob/5.1.x/httpclient5/src/main/java/org/apache/hc/client5/http/impl/classic/RedirectExec.java#L117] (which is equivalent to line 118 in 5.0.x), {{currentRequest}} has 4 headers, NOT including the {{Authorization}} header. (Frames: RedirectExec.java, execute:117; ExecChainElement, execute:51; InternalHttpClient, doExecute:170; ClosableHttpClient, execute:75; ClientPreemptiveBasicAuthentication, main:66)



--
This message was sent by Atlassian Jira
(v8.20.1#820001)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org