microsoft / microsoft/BCApps

[Bug]: Calling SetAuthorizationHeader twice on the same RestClient instance causes an Authorization header collision (Invalid HTTP Header)

Open Beginner friendly
#7,581 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

AI-Triage Approved Team: Integrations
Dominant language
AL
Stars
683
Forks
459
Avg merge
3d 26m
Merged PRs (30d)
633

Description

Describe the issue

In the "Rest Client" codeunit (codeunit 2350) calling SetAuthorizationHeader twice on the same instance, causes a header collision. This is due to the SetDefaultRequestHeader procedure implementation in codeunit 2351 "Rest Client Impl." that checks for existing header with method Contains, rather than ContainsSecret if the value of the header is a SecretText.
The error that is displayed as a result is: Invalid HTTP header. Please, make sure the format of the header is correct.

Expected behavior

Calling the procedure twice should remove the previous value of the header and replace it with a new one.

Steps to reproduce
  1. Create an action on Page
  2. In the trigger of the action add variable: RestClient: Codeunit "Rest Client"
  3. Call procedures in this order: RestClient.Initalize, RestClient.SetAuthorizationHeader(...), RestClient.SetAuthorizationHeader(...)
  4. Run the action from Page
  5. It will throw an error: Invalid HTTP header. Please, make sure the format of the header is correct. on the second call

Sample code for reproduction:

trigger OnAction()
var
    RestClient: Codeunit "Rest Client";
begin
    RestClient.Initialize();
    RestClient.SetAuthorizationHeader(SecretStrSubstNo('Bearer test'));
    RestClient.SetAuthorizationHeader(SecretStrSubstNo('Bearer test'));
end;
Additional context
Image
I will provide a fix for a bug
  • I will provide a fix for a bug

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in codeunit 2351, "Rest Client Impl.", and inspect SetDefaultRequestHeader, then trace how codeunit 2350, "Rest Client", calls it from SetAuthorizationHeader. Reproduce the issue with the AL action shown in the report. Done means calling SetAuthorizationHeader twice replaces the previous value without producing an invalid-header error.

Written by the indexing model from the issue text.

Assessment

Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.