Skip to content

Commit 2709575

Browse files
pratt4pratt4
authored
Merge branch 'main' into digest-auth-new
2 parents 867f50e + eeec334 commit 2709575

File tree

8 files changed

+205
-12
lines changed

8 files changed

+205
-12
lines changed

‎.github/workflows/builds.yml

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,39 +5,55 @@ on:
55
- cron: '0 12 * * *'
66

77
jobs:
8+
Verify:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@v4
12+
- name: Grant Permission
13+
run: chmod +x ./mvnw
14+
- uses: actions/setup-java@v4
15+
with:
16+
distribution: 'corretto'
17+
java-version: '11'
18+
- name: Verify
19+
run: ./mvnw -B -ntp clean verify -DskipTests -Dgpg.skip=true
20+
821
RunOnLinux:
922
runs-on: ubuntu-latest
23+
needs: Verify
1024
steps:
1125
- uses: actions/checkout@v4
1226
- name: Grant Permission
13-
run: sudo chmod +x ./mvnw
27+
run: chmod +x ./mvnw
1428
- uses: actions/setup-java@v4
1529
with:
1630
distribution: 'corretto'
1731
java-version: '11'
1832
- name: Run Tests
19-
run: ./mvnw -B -ntp clean test
33+
run: ./mvnw -B -ntp test
2034

2135
RunOnMacOs:
2236
runs-on: macos-latest
37+
needs: Verify
2338
steps:
2439
- uses: actions/checkout@v4
2540
- name: Grant Permission
26-
run: sudo chmod +x ./mvnw
41+
run: chmod +x ./mvnw
2742
- uses: actions/setup-java@v4
2843
with:
2944
distribution: 'corretto'
3045
java-version: '11'
3146
- name: Run Tests
32-
run: ./mvnw -B -ntp clean test
47+
run: ./mvnw -B -ntp test
3348

3449
RunOnWindows:
3550
runs-on: windows-latest
51+
needs: Verify
3652
steps:
3753
- uses: actions/checkout@v4
3854
- uses: actions/setup-java@v4
3955
with:
4056
distribution: 'corretto'
4157
java-version: '11'
4258
- name: Run Tests
43-
run: ./mvnw.cmd -B -ntp clean test
59+
run: ./mvnw.cmd -B -ntp test

‎client/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
<javaModuleName>org.asynchttpclient.client</javaModuleName>
3232

3333
<jetty.version>11.0.24</jetty.version>
34-
<tomcat.version>10.1.39</tomcat.version>
34+
<tomcat.version>10.1.41</tomcat.version>
3535
<commons-io.version>2.18.0</commons-io.version>
3636
<mockito.version>4.11.0</mockito.version>
3737
<hamcrest.version>3.0</hamcrest.version>

‎client/src/main/java/org/asynchttpclient/AsyncHttpClientConfig.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,13 @@ public interface AsyncHttpClientConfig {
375375

376376
int getIoThreadsCount();
377377

378+
/**
379+
* Indicates whether the Authorization header should be stripped during redirects to a different domain.
380+
*
381+
* @return true if the Authorization header should be stripped, false otherwise.
382+
*/
383+
boolean isStripAuthorizationOnRedirect();
384+
378385
enum ResponseBodyPartFactory {
379386

380387
EAGER {

‎client/src/main/java/org/asynchttpclient/DefaultAsyncHttpClientConfig.java

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,7 @@ public class DefaultAsyncHttpClientConfig implements AsyncHttpClientConfig {
127127
private final boolean keepEncodingHeader;
128128
private final ProxyServerSelector proxyServerSelector;
129129
private final boolean validateResponseHeaders;
130+
private final boolean stripAuthorizationOnRedirect;
130131

131132
// websockets
132133
private final boolean aggregateWebSocketFrameFragments;
@@ -219,6 +220,7 @@ private DefaultAsyncHttpClientConfig(// http
219220
boolean validateResponseHeaders,
220221
boolean aggregateWebSocketFrameFragments,
221222
boolean enablewebSocketCompression,
223+
boolean stripAuthorizationOnRedirect,
222224

223225
// timeouts
224226
Duration connectTimeout,
@@ -307,6 +309,7 @@ private DefaultAsyncHttpClientConfig(// http
307309
this.keepEncodingHeader = keepEncodingHeader;
308310
this.proxyServerSelector = proxyServerSelector;
309311
this.validateResponseHeaders = validateResponseHeaders;
312+
this.stripAuthorizationOnRedirect = stripAuthorizationOnRedirect;
310313

311314
// websocket
312315
this.aggregateWebSocketFrameFragments = aggregateWebSocketFrameFragments;
@@ -564,6 +567,11 @@ public boolean isValidateResponseHeaders() {
564567
return validateResponseHeaders;
565568
}
566569

570+
@Override
571+
public boolean isStripAuthorizationOnRedirect() {
572+
return stripAuthorizationOnRedirect;
573+
}
574+
567575
// ssl
568576
@Override
569577
public boolean isUseOpenSsl() {
@@ -800,6 +808,7 @@ public static class Builder {
800808
private boolean useProxySelector = defaultUseProxySelector();
801809
private boolean useProxyProperties = defaultUseProxyProperties();
802810
private boolean validateResponseHeaders = defaultValidateResponseHeaders();
811+
private boolean stripAuthorizationOnRedirect = false; // default value
803812

804813
// websocket
805814
private boolean aggregateWebSocketFrameFragments = defaultAggregateWebSocketFrameFragments();
@@ -891,6 +900,7 @@ public Builder(AsyncHttpClientConfig config) {
891900
keepEncodingHeader = config.isKeepEncodingHeader();
892901
proxyServerSelector = config.getProxyServerSelector();
893902
validateResponseHeaders = config.isValidateResponseHeaders();
903+
stripAuthorizationOnRedirect = config.isStripAuthorizationOnRedirect();
894904

895905
// websocket
896906
aggregateWebSocketFrameFragments = config.isAggregateWebSocketFrameFragments();
@@ -1079,6 +1089,11 @@ public Builder setUseProxyProperties(boolean useProxyProperties) {
10791089
return this;
10801090
}
10811091

1092+
public Builder setStripAuthorizationOnRedirect(boolean value) {
1093+
stripAuthorizationOnRedirect = value;
1094+
return this;
1095+
}
1096+
10821097
// websocket
10831098
public Builder setAggregateWebSocketFrameFragments(boolean aggregateWebSocketFrameFragments) {
10841099
this.aggregateWebSocketFrameFragments = aggregateWebSocketFrameFragments;
@@ -1444,6 +1459,7 @@ public DefaultAsyncHttpClientConfig build() {
14441459
validateResponseHeaders,
14451460
aggregateWebSocketFrameFragments,
14461461
enablewebSocketCompression,
1462+
stripAuthorizationOnRedirect,
14471463
connectTimeout,
14481464
requestTimeout,
14491465
readTimeout,

‎client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@
3535
import org.slf4j.LoggerFactory;
3636

3737
import java.util.HashSet;
38-
import java.util.List;
3938
import java.util.Set;
4039

4140
import static io.netty.handler.codec.http.HttpHeaderNames.AUTHORIZATION;
@@ -73,11 +72,13 @@ public class Redirect30xInterceptor {
7372
private final AsyncHttpClientConfig config;
7473
private final NettyRequestSender requestSender;
7574
private final MaxRedirectException maxRedirectException;
75+
private final boolean stripAuthorizationOnRedirect;
7676

7777
Redirect30xInterceptor(ChannelManager channelManager, AsyncHttpClientConfig config, NettyRequestSender requestSender) {
7878
this.channelManager = channelManager;
7979
this.config = config;
8080
this.requestSender = requestSender;
81+
stripAuthorizationOnRedirect = config.isStripAuthorizationOnRedirect(); // New flag
8182
maxRedirectException = unknownStackTrace(new MaxRedirectException("Maximum redirect reached: " + config.getMaxRedirects()),
8283
Redirect30xInterceptor.class, "exitAfterHandlingRedirect");
8384
}
@@ -127,7 +128,7 @@ public boolean exitAfterHandlingRedirect(Channel channel, NettyResponseFuture<?>
127128
}
128129
}
129130

130-
requestBuilder.setHeaders(propagatedHeaders(request, realm, keepBody));
131+
requestBuilder.setHeaders(propagatedHeaders(request, realm, keepBody, stripAuthorizationOnRedirect));
131132

132133
// in case of a redirect from HTTP to HTTPS, future
133134
// attributes might change
@@ -180,7 +181,7 @@ public boolean exitAfterHandlingRedirect(Channel channel, NettyResponseFuture<?>
180181
return false;
181182
}
182183

183-
private static HttpHeaders propagatedHeaders(Request request, Realm realm, boolean keepBody) {
184+
private static HttpHeaders propagatedHeaders(Request request, Realm realm, boolean keepBody, boolean stripAuthorization) {
184185
HttpHeaders headers = request.getHeaders()
185186
.remove(HOST)
186187
.remove(CONTENT_LENGTH);
@@ -189,7 +190,7 @@ private static HttpHeaders propagatedHeaders(Request request, Realm realm, boole
189190
headers.remove(CONTENT_TYPE);
190191
}
191192

192-
if (realm != null && realm.getScheme() == AuthScheme.NTLM) {
193+
if (stripAuthorization || (realm != null && realm.getScheme() == AuthScheme.NTLM)) {
193194
headers.remove(AUTHORIZATION)
194195
.remove(PROXY_AUTHORIZATION);
195196
}

‎client/src/test/java/org/asynchttpclient/DefaultAsyncHttpClientConfigTest.java

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
package org.asynchttpclient;
2+
3+
import org.junit.jupiter.api.Test;
4+
5+
import static org.junit.jupiter.api.Assertions.assertFalse;
6+
import static org.junit.jupiter.api.Assertions.assertTrue;
7+
8+
class DefaultAsyncHttpClientConfigTest {
9+
@Test
10+
void testStripAuthorizationOnRedirect_DefaultIsFalse() {
11+
DefaultAsyncHttpClientConfig config = new DefaultAsyncHttpClientConfig.Builder().build();
12+
assertFalse(config.isStripAuthorizationOnRedirect(), "Default should be false");
13+
}
14+
15+
@Test
16+
void testStripAuthorizationOnRedirect_SetTrue() {
17+
DefaultAsyncHttpClientConfig config = new DefaultAsyncHttpClientConfig.Builder()
18+
.setStripAuthorizationOnRedirect(true)
19+
.build();
20+
assertTrue(config.isStripAuthorizationOnRedirect(), "Should be true when set");
21+
}
22+
23+
@Test
24+
void testStripAuthorizationOnRedirect_SetFalse() {
25+
DefaultAsyncHttpClientConfig config = new DefaultAsyncHttpClientConfig.Builder()
26+
.setStripAuthorizationOnRedirect(false)
27+
.build();
28+
assertFalse(config.isStripAuthorizationOnRedirect(), "Should be false when set to false");
29+
}
30+
}

‎client/src/test/java/org/asynchttpclient/StripAuthorizationOnRedirectHttpTest.java

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
package org.asynchttpclient;
2+
3+
import com.sun.net.httpserver.HttpExchange;
4+
import com.sun.net.httpserver.HttpHandler;
5+
import com.sun.net.httpserver.HttpServer;
6+
import org.junit.jupiter.api.AfterAll;
7+
import org.junit.jupiter.api.BeforeAll;
8+
import org.junit.jupiter.api.Test;
9+
10+
import java.net.InetSocketAddress;
11+
import java.util.concurrent.TimeUnit;
12+
13+
import static org.junit.jupiter.api.Assertions.assertEquals;
14+
import static org.junit.jupiter.api.Assertions.assertNull;
15+
16+
public class StripAuthorizationOnRedirectHttpTest {
17+
private static HttpServer server;
18+
private static int port;
19+
private static volatile String lastAuthHeader;
20+
21+
@BeforeAll
22+
public static void startServer() throws Exception {
23+
server = HttpServer.create(new InetSocketAddress(0), 0);
24+
port = server.getAddress().getPort();
25+
server.createContext("/redirect", new RedirectHandler());
26+
server.createContext("/final", new FinalHandler());
27+
server.start();
28+
}
29+
30+
@AfterAll
31+
public static void stopServer() {
32+
server.stop(0);
33+
}
34+
35+
static class RedirectHandler implements HttpHandler {
36+
@Override
37+
public void handle(HttpExchange exchange) {
38+
String auth = exchange.getRequestHeaders().getFirst("Authorization");
39+
lastAuthHeader = auth;
40+
exchange.getResponseHeaders().add("Location", "http://localhost:" + port + "/final");
41+
try {
42+
exchange.sendResponseHeaders(302, -1);
43+
} catch (Exception ignored) {
44+
}
45+
exchange.close();
46+
}
47+
}
48+
49+
static class FinalHandler implements HttpHandler {
50+
@Override
51+
public void handle(HttpExchange exchange) {
52+
String auth = exchange.getRequestHeaders().getFirst("Authorization");
53+
lastAuthHeader = auth;
54+
try {
55+
exchange.sendResponseHeaders(200, 0);
56+
exchange.getResponseBody().close();
57+
} catch (Exception ignored) {
58+
}
59+
exchange.close();
60+
}
61+
}
62+
63+
@Test
64+
void testAuthHeaderPropagatedByDefault() throws Exception {
65+
DefaultAsyncHttpClientConfig config = new DefaultAsyncHttpClientConfig.Builder()
66+
.setFollowRedirect(true)
67+
.build();
68+
try (DefaultAsyncHttpClient client = new DefaultAsyncHttpClient(config)) {
69+
lastAuthHeader = null;
70+
client.prepareGet("http://localhost:" + port + "/redirect")
71+
.setHeader("Authorization", "Bearer testtoken")
72+
.execute()
73+
.get(5, TimeUnit.SECONDS);
74+
// By default, Authorization header is propagated to /final
75+
assertEquals("Bearer testtoken", lastAuthHeader, "Authorization header should be present on redirect by default");
76+
}
77+
}
78+
79+
@Test
80+
void testAuthHeaderStrippedWhenEnabled() throws Exception {
81+
DefaultAsyncHttpClientConfig config = new DefaultAsyncHttpClientConfig.Builder()
82+
.setFollowRedirect(true)
83+
.setStripAuthorizationOnRedirect(true)
84+
.build();
85+
try (DefaultAsyncHttpClient client = new DefaultAsyncHttpClient(config)) {
86+
lastAuthHeader = null;
87+
client.prepareGet("http://localhost:" + port + "/redirect")
88+
.setHeader("Authorization", "Bearer testtoken")
89+
.execute()
90+
.get(5, TimeUnit.SECONDS);
91+
// When enabled, Authorization header should be stripped on /final
92+
assertNull(lastAuthHeader, "Authorization header should be stripped on redirect when enabled");
93+
}
94+
}
95+
}

‎pom.xml

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,14 +105,14 @@
105105
<dependency>
106106
<groupId>org.junit</groupId>
107107
<artifactId>junit-bom</artifactId>
108-
<version>5.11.4</version>
108+
<version>5.13.0</version>
109109
<type>pom</type>
110110
<scope>import</scope>
111111
</dependency>
112112
<dependency>
113113
<groupId>io.github.nettyplus</groupId>
114114
<artifactId>netty-leak-detector-junit-extension</artifactId>
115-
<version>0.0.8</version>
115+
<version>0.2.0</version>
116116
</dependency>
117117
</dependencies>
118118
</dependencyManagement>
@@ -422,10 +422,38 @@
422422
<arg>--pinentry-mode</arg>
423423
<arg>loopback</arg>
424424
</gpgArguments>
425+
<gpg.skip>false</gpg.skip>
425426
</configuration>
426427
</execution>
427428
</executions>
428429
</plugin>
430+
431+
<plugin>
432+
<groupId>com.github.siom79.japicmp</groupId>
433+
<artifactId>japicmp-maven-plugin</artifactId>
434+
<version>0.23.1</version>
435+
<configuration>
436+
<version>
437+
<old>RELEASE</old>
438+
<new>${project.version}</new>
439+
</version>
440+
<parameter>
441+
<onlyModified>true</onlyModified>
442+
<breakBuildOnBinaryIncompatibleModifications>true</breakBuildOnBinaryIncompatibleModifications>
443+
<breakBuildOnSourceIncompatibleModifications>true</breakBuildOnSourceIncompatibleModifications>
444+
<includeSynthetic>false</includeSynthetic>
445+
<accessModifier>public</accessModifier>
446+
</parameter>
447+
</configuration>
448+
<executions>
449+
<execution>
450+
<goals>
451+
<goal>cmp</goal>
452+
</goals>
453+
<phase>verify</phase>
454+
</execution>
455+
</executions>
456+
</plugin>
429457
</plugins>
430458
</build>
431459
</project>

0 commit comments

Comments
 (0)