DO NOT REPLY [Bug 10532] New: - Authorization credentials should be sent pre-emptively

[bu...@apache.org]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10532>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10532

Authorization credentials should be sent pre-emptively

           Summary: Authorization credentials should be sent pre-emptively
           Product: Commons
           Version: 2.0 Alpha 1
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: Other
         Component: HttpClient
        AssignedTo: commons-dev@jakarta.apache.org
        ReportedBy: jsdever@sympatico.ca


When a web browser receives a <i>401: Unauthorized</i> response code, the
browser prompts for the user and password credentials for the requested
authentication realm.  An Authorization header is then sent for this request. 
HttpClient models this behaviour quite well.

After the web browser has the authentication credentials for a given host, port
and realm, it then sends the Authorization header for subsequent requests
pre-emptively, whithout need for a 401 response.  HttpClient always reqires a
401 response before it will send out the Authorization header.

As <code>HttpClient.startSession()</code> will take a <code>Credentials</code>
object as a parameter as the default credentials, the default credentials should
be sent as part of every request in that session.  Some mechanisim for
over-riding the default credentials should also be provided to be sent
pre-emptively.

The point of this enhancement request is to minimize the number of unnecessisary
401 responses.

It appears that the simple solution might be to modify the logic of when
<code>Authenticator.authenticate()</code> gets called in
<code>HttpMethodBase.addAuthorizationRequestHeader()</code>

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>