[HTTPCLIENT-1344] Userinfo Credentials in URI Should Not Default to Preemptive Authentication

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.2.4
• Fix Version/s: 4.3 Beta2
• Component/s: HttpClient (classic)
• Assignee: Unassigned
• Reporter: James Leigh
• Created: 20/Apr/13 02:51
• Updated: 05/Oct/13 19:42
• Resolved: 16/May/13 14:18

Description

When using a request like new HttpGet("http://user:[e-mail]/") HttpClient will send along Authorization: Basic header with the first request (even if the server uses Digest Access).

The expected behaviour is for HttpClient to send a request with no user credentials at all, wait for the server to send a 401 response. Then based on the supported auth scheme, send another request with the credentials in a scheme that is supported by the server.