[CXF-4318] OAuthRequestFilter generates an empty WWW-Authenticate header

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.6
• Fix Version/s: 2.6.1
• Component/s: JAX-RS Security
• Labels: oauth2
• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: Jordi Gerona
• Created: 15/May/12 15:57
• Updated: 05/Jun/12 13:31
• Resolved: 15/May/12 20:37

Description

When using OAuthRequestFilter to protect a resource if we don't set any member for its "tokenHandlers" list, a request without an "Authorization" header will generate a response like:

Response-Code: 401
Content-Type: text/xml
Headers:

{WWW-Authenticate=[], Date=[Tue, 15 May 2012 15:27:43 GMT], Content-Length=[0]}

And when trying to process it at the client layer a "java.lang.IllegalArgumentException" will be thrown:

URL uri = new URL("http://SomeFilteredResource");
HttpURLConnection conn = (HttpURLConnection)uri.openConnection();
int code = conn.getResponseCode();

Receives:

java.lang.RuntimeException: java.lang.IllegalArgumentException: invalid start or end
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1137)
at sun.net.www.protocol.http.HttpURLConnection.getHeaderField(HttpURLConnection.java:2338)
at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:388)

I suppose the reason could be the empty "WWW-Authenticate" header's value, so the method AuthorizationUtils.throwAuthorizationFailure() should be fixed to avoid this situation

Regards