[HTTPCLIENT-1345] Useinfo Credentials Ignored In Redirect Location Header

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.2.4
• Fix Version/s: 4.3 Beta2
• Component/s: HttpClient (classic)
• Assignee: Unassigned
• Reporter: James Leigh
• Created: 20/Apr/13 02:59
• Updated: 05/Oct/13 19:41
• Resolved: 16/May/13 14:19

Description

When HttpClient is configured to follow redirects and receives an 303 response with a
Location header that includes userinfo, such as http://user:[e-mail]/ the username and password are ignored.

The expected behaviour is that if the request to the target location (without credentials) responds with a 401, that HttpClient would use the userinfo credentials in the previous response Location header to authenticate and store the credentials in the execution context. This is the behaviour of most Web agents such as Chrome, Firefox, Safari, libcurl, and others.

HttpClient should still wait for the 401 response (by default) before sending the credentials as outlined in 1344:
Userinfo Credentials in URI Should Not Default to Preemptive Authentication
https://issues.apache.org/jira/browse/HTTPCLIENT-1344