eclipse-ee4j / eclipse-ee4j/jersey

HttpAuthenticationFeature should have a callback mechanism to get credentials

Open
#3,136 4 comments 0 reactions 0 assignees View on GitHub
Component: security Priority: Major Type: New Feature
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

Instead of configuring the credentials directly on the HttpAuthenticationFeature you should be able to provide a callback. That way, in pre-emptive mode, the credentials can be obtained by asking the user for them on-demand. The HttpAuthenticationFeature should then cache them for the given authentication realm.

I currently implement this with my own ClientRequestFilter that adds the authorization header from a cache of credentials, and a reflection-based proxy in my client that intercepts the 401 status, populates the credentials cache via a callback (where I can present a GUI), then retries the call. It works, but it is the sort of thing that should be built-in if you ask me.
#### Environment
all
#### Affected Versions
[2.17]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.