[LOG4J2-3481] HttpWatcher does not pass credentials when polling

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.17.2
• Fix Version/s: 2.18.0
• Component/s: Core
• Assignee: Ralph Goers
• Reporter: Ralph Goers
• Created: 20/Apr/22 14:32
• Updated: 02/May/22 15:45
• Resolved: 02/May/22 15:45

Description

When a configuration is retrieved via HTTP the ConfigurationSource determines the AuthorizationProvider to use and does not save it. However, when the HttpWatcher runs it retrieves the AuthorizationProvider from a static variable in ConfigurationFactory that has not been initialized, so polling requests return with a 401.

Note that when Spring events are raised