Add NextNonceInterceptor for nextnonce extraction from Authentication-Info headers #596
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ok2c
requested changes
Nov 2, 2024
| Args.notNull(response, "HTTP response"); | ||
| Args.notNull(context, "HTTP context"); | ||
|
|
||
| final Header header = response.getFirstHeader(AUTHENTICATION_INFO_HEADER); |
There was a problem hiding this comment.
@arturobernalg This can be made more efficient by checking if the header is FormattedHeader and re-using its internal attributes and eliminating an extra intermediate String.
if (header instanceof FormattedHeader) {
final CharArrayBuffer buf = ((FormattedHeader) header).getBuffer();
final ParserCursor cursor = new ParserCursor(0, buf.length());
cursor.updatePos(((FormattedHeader) header).getValuePos());
parseNextNonce(buf, cursor;
} else {
final String value = header.getValue();
final ParserCursor cursor = new ParserCursor(0, value.length());
parseNextNonce(buf, cursor;
|
|
||
| if (context != null) { | ||
| final HttpClientContext clientContext = HttpClientContext.cast(context); | ||
| final String nextNonce = clientContext.getAttribute("auth-nextnonce", String.class); |
There was a problem hiding this comment.
@arturobernalg Maybe this deserves being an attribute in the context. Up to you.
There was a problem hiding this comment.
@ok2c that is a good idea. I made all the necessary change.
arturobernalg
force-pushed
the
nextnonce
branch
from
8bd6a6b to
99a1404
Compare
ok2c
requested changes
Nov 3, 2024
| * @param cursor the {@link ParserCursor} used to navigate through the buffer content | ||
| * @return the extracted {@code nextnonce} parameter value, or {@code null} if the parameter is not found | ||
| */ | ||
| private String parseNextNonce(final CharArrayBuffer buffer, final ParserCursor cursor) { |
There was a problem hiding this comment.
@arturobernalg Please use CharSequence instead of CharArrayBuffer here.
| } else { | ||
| final String headerValue = header.getValue(); | ||
| final ParserCursor cursor = new ParserCursor(0, headerValue.length()); | ||
| final CharArrayBuffer buf = new CharArrayBuffer(headerValue.length()); |
There was a problem hiding this comment.
@arturobernalg This intermediate buffer will become unnecessary.
…in HTTP Digest Access Authentication, extracting the `nextnonce` parameter when present and storing it in `HttpClientContext`. This supports compliance with RFC 7616, enhancing client authentication continuity.
arturobernalg
force-pushed
the
nextnonce
branch
from
1d91748 to
e1fbf1a
Compare
ok2c
approved these changes
Nov 3, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR introduces the
NextNonceInterceptorto process HTTP responses with Authentication-Info headers by extracting thenextnonceparameter, as specified in RFC 7616. The interceptor checks for the presence of this header, retrieves thenextnoncevalue if available, and stores it within theHttpContextunder the attributeauth-nextnonce.This mechanism supports secure client authentication workflows by allowing continuity in nonce-based authentication challenges.