[
https://issues.apache.org/jira/browse/CXF-4815?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13573650#comment-13573650
]
Christian Schneider commented on CXF-4815:
------------------------------------------
This does not fully solve the problem. The authenticator now returns
username/password one time and null on the next call. This makes
HttpUrlConnection do 2 requests instead of 20 but it should be only one.
After talking to Dan we agreed that CXFAuthenticator should always return null
in case of basic or digest auth as we are handling this in the HttpConduit
already. A first test in Syncope shows that this seems to fix the issue. I will
prepare a fix for this.
> Invalid login creds will send many requests to server
> -----------------------------------------------------
>
> Key: CXF-4815
> URL: https://issues.apache.org/jira/browse/CXF-4815
> Project: CXF
> Issue Type: Bug
> Components: Transports
> Affects Versions: 2.5.9, 2.6.6, 2.7.3
> Reporter: Daniel Kulp
> Assignee: Daniel Kulp
> Fix For: 2.7.4, 2.6.7, 2.5.10
>
>
> If you set authorizations stuff in the HTTPConduit with a wrong password or
> username and issue a GET, 20 requests are sent to the server. For
> non-streaming connections (like GET), for the 401 response, the
> HttpURLConnection calls the Authenticator to get auth information. We create
> a new PasswordAuthentication object and return it each time. However, the
> HttpURLConnection does not compare that returned value with the previous
> value and will keep trying until it hits the http.maxRedirects value (default
> is 20).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
