[HTTPCLIENT-1458] SystemDefaultCredentialsProvider authenticates with wrong protocol for https requests

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.3.2
• Fix Version/s: 4.4 Alpha1
• Component/s: HttpClient (classic)
• Environment: Client: Oracle Java 6/7.
• Assignee: Unassigned
• Reporter: Mat Gessel
• Created: 07/Feb/14 20:23
• Updated: 04/May/17 09:49
• Resolved: 13/Feb/14 14:30

Description

Java has system property settings for specifying proxies. Java has different properties for "http" and "https". The purpose of HttpClient's SystemDefaultCredentialsProvider is to delegate authentication to a java.net.Authenticator. Authenticator implementations commonly use the proxy system properties. However, SDCP loses the differentiation between "http" and "https"; it always requests auth for "http".

SystemDefaultCredentialsProvider always passes "http" as the protocol to Authenticator.requestPasswordAuthentication(). This can result in an HTTP status 407 or other 3rd party errors due to a protocol mismatch.

Here is an example of a default Authenticator that will fail because it relies on the https.proxyXXX properties.

Authenticator.setDefault(new Authenticator()
{
@Override
protected PasswordAuthentication getPasswordAuthentication()
{
if (getRequestorType() == RequestorType.PROXY)
{
if ("https".equals(getRequestingProtocol().toLowerCase()))
{
String host = System.getProperty("https.proxyHost", "");
String port = System.getProperty("https.proxyPort", "443");
String user = System.getProperty("https.proxyUser", "");
String password = System.getProperty("https.proxyPassword", "");

if (getRequestingHost().equalsIgnoreCase(host))
{
if (port != null && port.equals(Integer.toString(getRequestingPort())))

{ return new PasswordAuthentication(user, password.toCharArray()); }

}
}
}
return null;
}
});

JRE 7 Networking Properties:
http://docs.oracle.com/javase/7/docs/api/java/net/doc-files/net-properties.html

Workaround:
IF: a single proxy is used and it supports http and https on the same port
THEN: set http.proxyXXX and https.proxyXXX system properties to the same host/port.