Hsnmohd commented on PR #925: URL: https://github.com/apache/httpcomponents-client/pull/925#issuecomment-6672098708
Not really. A host:port is one listener. It can act as both a proxy and an origin (httpd with mod_proxy, say), but that's still one endpoint under one admin, and the realm is what separates its protection spaces. Keying credentials on (host, port, realm, scheme) is right, and this PR doesn't change that. The leak comes from the requestor type, not the scope. On a 401 from an origin, the provider asks the Authenticator for SERVER and then for PROXY at the origin's host:port, which tells the Authenticator the origin is a proxy. The JDK's own clients only ask for PROXY on a 407 from the configured proxy, so the usual Authenticator hands out the proxy password whenever `getRequestorType() == PROXY` and never checks the host. With `HttpClients.createDefault()`, any server that answers 401 Basic gets that password. `getCredentials` can't see whether the challenge was a 401 or a 407, so the PR relies on the point above: the host:port the current request is addressed to is the origin for that request, not its proxy, so it only gets the SERVER lookup. A 407 is scoped to the proxy's host:port, which differs from the request target for both forwarded requests and CONNECT, so proxy auth works as before. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
