eclipse-ee4j / eclipse-ee4j/jersey

basic authenticator ignores sslContext in repeatRequest()

Open
#3,420 3 comments 0 reactions 0 assignees View on GitHub
Component: connectors Priority: Critical Type: Bug
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

In a basic authentication scenario, the custom trustStore or sslContext configured in a jersey Client, is droped/ignored/not-cloned/not-copied by the HttpAuthenticationFilter.repeatRequest() method - and as a result repatRequest() creates a new client with a default trustStore, which causes the second basic authentication request to fail with an SSLHandshakeException (i.e. in the case the server side uses a self-signed certificate).

The repeatRequest() method creates a new client by calling ClientBuilder.newClient(request.getConfiguration()). However the JerseyClientBuilder.newClient() implementation does not copy the SSLContext from the original configuration.

A simple workaround, by specifying a custom factory under META-INF/services/javax.ws.rs.client.ClientBuilder might look like this:

```
public class JerseyClientBuilderFix extends JerseyClientBuilder {
@Override
public JerseyClientBuilder withConfig(Configuration config) {
JerseyClientBuilder res = super.withConfig(config);
if(config instanceof ClientConfig) {
JerseyClient client = ((ClientConfig)config).getClient();
if(client != null){
SSLContext sslContext = client.getSslContext();
res.sslContext(sslContext);
}
}
return res;
}
}
```

however I wonder if it wouldn't be better to:

* let JerseyClientBuilder.withConfig() also copy the SSL relevant settings
* let repeatRequest() reuse the existing Client
#### Environment
any
#### Affected Versions
[2.23.1]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.