eclipse-ee4j / eclipse-ee4j/jersey
basic authenticator ignores sslContext in repeatRequest()
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
In a basic authentication scenario, the custom trustStore or sslContext configured in a jersey Client, is droped/ignored/not-cloned/not-copied by the HttpAuthenticationFilter.repeatRequest() method - and as a result repatRequest() creates a new client with a default trustStore, which causes the second basic authentication request to fail with an SSLHandshakeException (i.e. in the case the server side uses a self-signed certificate).
The repeatRequest() method creates a new client by calling ClientBuilder.newClient(request.getConfiguration()). However the JerseyClientBuilder.newClient() implementation does not copy the SSLContext from the original configuration.
A simple workaround, by specifying a custom factory under META-INF/services/javax.ws.rs.client.ClientBuilder might look like this:
```
public class JerseyClientBuilderFix extends JerseyClientBuilder {
@Override
public JerseyClientBuilder withConfig(Configuration config) {
JerseyClientBuilder res = super.withConfig(config);
if(config instanceof ClientConfig) {
JerseyClient client = ((ClientConfig)config).getClient();
if(client != null){
SSLContext sslContext = client.getSslContext();
res.sslContext(sslContext);
}
}
return res;
}
}
```
however I wonder if it wouldn't be better to:
* let JerseyClientBuilder.withConfig() also copy the SSL relevant settings
* let repeatRequest() reuse the existing Client
#### Environment
any
#### Affected Versions
[2.23.1]
Contributor guide
Assessment
This issue has not been assessed yet.