You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by "bitfire (JIRA)" <ji...@apache.org> on 2014/12/21 02:19:13 UTC
[jira] [Commented] (HTTPCLIENT-1566) Obvious bug in HTTP Basic
Authentication!
[ https://issues.apache.org/jira/browse/HTTPCLIENT-1566?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14254996#comment-14254996 ]
bitfire commented on HTTPCLIENT-1566:
-------------------------------------
Thanks for fixing this bug. I have just experienced it when using the "org.apache.httpcomponents:httpclient-android:4.3.5" gradle dependency.
Would it be possible to release a 4.3.6 version soon?
> Obvious bug in HTTP Basic Authentication!
> -----------------------------------------
>
> Key: HTTPCLIENT-1566
> URL: https://issues.apache.org/jira/browse/HTTPCLIENT-1566
> Project: HttpComponents HttpClient
> Issue Type: Bug
> Components: Android Port
> Affects Versions: 4.3.5
> Reporter: Rainer Burgstaller
> Fix For: 4.3.5.1-android
>
>
> There is an obvious bug in android httpclient 4.3.5 in {{BasicSchemeHC4.authenticate()}}
> {code:java}
> /**
> * Produces basic authorization header for the given set of {@link Credentials}.
> *
> * @param credentials The set of credentials to be used for authentication
> * @param request The request being authenticated
> * @throws org.apache.http.auth.InvalidCredentialsException if authentication
> * credentials are not valid or not applicable for this authentication scheme
> * @throws AuthenticationException if authorization string cannot
> * be generated due to an authentication failure
> *
> * @return a basic authorization string
> */
> @Override
> public Header authenticate(
> final Credentials credentials,
> final HttpRequest request,
> final HttpContext context) throws AuthenticationException {
> Args.notNull(credentials, "Credentials");
> Args.notNull(request, "HTTP request");
> final StringBuilder tmp = new StringBuilder();
> tmp.append(credentials.getUserPrincipal().getName());
> tmp.append(":");
> tmp.append((credentials.getPassword() == null) ? "null" : credentials.getPassword());
> final byte[] base64password = Base64.decode(
> EncodingUtils.getBytes(tmp.toString(), getCredentialsCharset(request)),
> Base64.NO_WRAP);
> {code}
> It is quite obvious that decoding a plaintext string "username:password" as Base64 will not work. The bug was introduced in revision {{1.616.447}}.
> This is the original code from HC
> {code:java}
> final byte[] base64password = base64codec.encode(
> EncodingUtils.getBytes(tmp.toString(), getCredentialsCharset(request)));
> {code}
> Please fix asap.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org