You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by "S Howlett (Jira)" <ji...@apache.org> on 2022/02/10 04:21:00 UTC
[jira] [Created] (HTTPCLIENT-2203) Credentials not sent when using preemptive auth
S Howlett created HTTPCLIENT-2203:
-------------------------------------
Summary: Credentials not sent when using preemptive auth
Key: HTTPCLIENT-2203
URL: https://issues.apache.org/jira/browse/HTTPCLIENT-2203
Project: HttpComponents HttpClient
Issue Type: Bug
Affects Versions: 5.1.3, 5.1.2, 5.1.1
Reporter: S Howlett
After version 5.0.3, preemptive auth appears to be broken, with the {{Authorization}} header missing from requests sent. I wonder if this may be related to the fix for HTTPCLIENT-2147.
I was able to reproduce this problem using the [Preemptive Authentication example|https://github.com/apache/httpcomponents-client/blob/5.1.x/httpclient5/src/test/java/org/apache/hc/client5/http/examples/ClientPreemptiveBasicAuthentication.java] provided in the [httpcomponents-client|https://github.com/apache/httpcomponents-client] GitHub repo. Below I outline the differences between the behaviour of HttpClient 5.0.3 and 5.1.1+ (using the Preemptive Authentication example, and Java 15.0.1). Nothing besides the HttpClient version was altered between the two cases.
h2. *HttpClient 5.0.3*
Preemptive Authentication example works as expected.
Output:
{code:java}
Executing request GET http://httpbin.org/hidden-basic-auth/user/passwd
----------------------------------------
200 OK
{
"authenticated": true,
"user": "user"
}
----------------------------------------
200 OK
{
"authenticated": true,
"user": "user"
}
----------------------------------------
200 OK
{
"authenticated": true,
"user": "user"
} {code}
Debugging showed that, at [RedirectExec.java, line 118|https://github.com/apache/httpcomponents-client/blob/5.0.x/httpclient5/src/main/java/org/apache/hc/client5/http/impl/classic/RedirectExec.java#L118], {{currentRequest}} has 5 headers, including the {{Authorization}} header with Basic credentials. (Frames: RedirectExec.java, execute:118; ExecChainElement, execute:51; InternalHttpClient, doExecute:178; ClosableHttpClient, execute:75; ClientPreemptiveBasicAuthentication, main:66)
h2. *{color:#172b4d}HttpClient 5.1.1{color} and above*
Credentials are not sent with requests in the Preemptive Authentication example.
Output:
{code:java}
Executing request GET http://httpbin.org/hidden-basic-auth/user/passwd
----------------------------------------
404 NOT FOUND
----------------------------------------
404 NOT FOUND
----------------------------------------
404 NOT FOUND {code}
Note: Not sure why the response is 404 with this URL; it is an authorisation issue and other URLs tend to return 403.
Debugging showed that, at [RedirectExec.java, line 117|https://github.com/apache/httpcomponents-client/blob/5.1.x/httpclient5/src/main/java/org/apache/hc/client5/http/impl/classic/RedirectExec.java#L117] (which is equivalent to line 118 in 5.0.x), {{currentRequest}} has 4 headers, NOT including the {{Authorization}} header. (Frames: RedirectExec.java, execute:117; ExecChainElement, execute:51; InternalHttpClient, doExecute:170; ClosableHttpClient, execute:75; ClientPreemptiveBasicAuthentication, main:66)
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org