[Bug]: Calling SetAuthorizationHeader twice on the same RestClient instance causes an Authorization header collision (Invalid HTTP Header)
Nobody has claimed this yet.
- Dominant language
- AL
- Stars
- 683
- Forks
- 459
- Avg merge
- 3d 26m
- Merged PRs (30d)
- 633
Description
Describe the issue
In the "Rest Client" codeunit (codeunit 2350) calling SetAuthorizationHeader twice on the same instance, causes a header collision. This is due to the SetDefaultRequestHeader procedure implementation in codeunit 2351 "Rest Client Impl." that checks for existing header with method Contains, rather than ContainsSecret if the value of the header is a SecretText.
The error that is displayed as a result is: Invalid HTTP header. Please, make sure the format of the header is correct.
Expected behavior
Calling the procedure twice should remove the previous value of the header and replace it with a new one.
Steps to reproduce
- Create an action on Page
- In the trigger of the action add variable: RestClient: Codeunit "Rest Client"
- Call procedures in this order: RestClient.Initalize, RestClient.SetAuthorizationHeader(...), RestClient.SetAuthorizationHeader(...)
- Run the action from Page
- It will throw an error:
Invalid HTTP header. Please, make sure the format of the header is correct.on the second call
Sample code for reproduction:
trigger OnAction()
var
RestClient: Codeunit "Rest Client";
begin
RestClient.Initialize();
RestClient.SetAuthorizationHeader(SecretStrSubstNo('Bearer test'));
RestClient.SetAuthorizationHeader(SecretStrSubstNo('Bearer test'));
end;
Additional context
I will provide a fix for a bug
- I will provide a fix for a bug
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in codeunit 2351, "Rest Client Impl.", and inspect SetDefaultRequestHeader, then trace how codeunit 2350, "Rest Client", calls it from SetAuthorizationHeader. Reproduce the issue with the AL action shown in the report. Done means calling SetAuthorizationHeader twice replaces the previous value without producing an invalid-header error.
Written by the indexing model from the issue text.
Assessment
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100