[HTTPCLIENT-1715] NTLMEngineImpl.Type1Message not thread safe but declared as a constant

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.5.1
• Fix Version/s: 4.5.2, 5.0 Alpha2
• Component/s: HttpClient (classic)
• Assignee: Gary D. Gregory
• Reporter: Olivier Lafontaine
• Created: 26/Jan/16 18:01
• Updated: 04/May/17 09:49
• Resolved: 27/Jan/16 08:35

Description

NTLMEngineImpl declares a static final member named TYPE_1_MESSAGE of type Type1Message. Members of Type1Message are final and do not change, but that is not the case for members of its superclass NTLMMessage.

Whenever the method NTLMEngineImpl#getType1Message(String, String) is called, the method NTLMMessage#getResponse() get called on the TYPE_1_MESSAGE instance and this modifies the following members of NTLMMessage:

• messageContents
• currentOutputPosition

This is not thread safe and we get exceptions as seen in HTTPCLIENT-1686.

My guess is that the computed response string should be kept in a constant instead of a Type1Message instance.

Issue Links

• relates to: HTTPCLIENT-1686 Threadsafe CloseableHttpClient uses non-threadsafe NTLMScheme, causing errors