Details
-
Bug
-
Status: Resolved
-
Major
-
Resolution: Duplicate
-
4.5.5
-
None
-
None
Description
We fail to authenticate against a gateway requiring authentication and which is tracking progress by way of setting and updating a session cookie even during the authentication challenge:
- client GET to some url https://a.b.c/
- response:
302, redirect to https://a.b.c/xyz
set cookie X=1
- response:
- client GET to url https://a.b.c/xyz
cookie X=1 transmitted- response:
401, authentication required
set cookie X=2
- response:
- client GET to same url again
authentication transmitted
cookie X=1 transmitted again, should have been X=2
This is caused by actually processing the cookies only outside the MainClientExec, by the calling ProtocolExec. But with receiving the 401, the loop in MainClientExec#execute(...) is not left but the request is sent again with having only added the authentication header. The cookies having received with the 401 response are dismissed.
Workaround (hack IMHO):
final TargetAuthenticationStrategy authStrategy = new TargetAuthenticationStrategy() { private final ResponseProcessCookies fResponseProcessCookies = new ResponseProcessCookies(); private final RequestAddCookies fRequestAddCookies = new RequestAddCookies(); @Override public Map<String, Header> getChallenges(HttpHost authhost, HttpResponse response, HttpContext context) throws MalformedChallengeException { try { fResponseProcessCookies.process(response, context); final HttpClientContext clientContext = HttpClientContext.adapt(context); final HttpRequest request = clientContext.getRequest(); request.removeHeaders("Cookie"); fRequestAddCookies.process(request, context); } catch (HttpException | IOException e) { throw new MalformedChallengeException(e.getMessage(), e); } return super.getChallenges(authhost, response, context); } }; final CloseableHttpClient authClient = httpClientBuilder .setTargetAuthenticationStrategy(authStrategy) .build();
Attachments
Issue Links
- duplicates
-
HTTPCLIENT-1451 HttpClient does not store response cookies on a 401
- Resolved