eclipse-ee4j / eclipse-ee4j/tyrus

Infinite loop detected after redirection and authorization challenge

Open
#732 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
128
Forks
49
PR merge metrics
No merged PRs in 30d

Description

Observed in tyrus client 1.17.

Consider the following scenario:
Connect to a websocket endpoint ws://myserver.example/myendpoint
The server uses HTTP Basic Auth *and* redirects you to use wss for obvious security reasons.
(Assume redirect is enabled in tyrus client).

The flow should be as follows:

Request ws://
Response 301
Request wss:// (without credentials)
Response 401
Request wss:// (with credentials)

The actual flow is:

Request ws://
Response 301
Request wss:// (without credentials)
Response 401
Request ws:// (with credentials)
Response 301
--- infinite loop detected ---

The reason is that tyrus uses the *old* (original) URL to comply with the authorization challenge, which of course results in another redirect. Since the client already followed the redirect in the current connection attempt, the infinite loop detection kicks in (see [here](https://github.com/eclipse-ee4j/tyrus/blob/65ec634bf6ada89efeae021e75b6227882514b6f/client/src/main/java/org/glassfish/tyrus/client/TyrusClientEngine.java#L434)).

I see two possible fixes:

1. Use the new URL to respond to the 401 challenge
2. Follow the redirect a second time (in other words: relax the infinite loop detection, maybe by using the threshold parameter)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.