1
1
public class InsecureBasicAuth {
2
2
/**
3
3
* Test basic authentication with Apache HTTP request.
4
- */
4
+ */
5
5
public void testApacheHttpRequest (String username , String password ) {
6
- {
6
+
7
7
// BAD: basic authentication over HTTP
8
8
String url = "http://www.example.com/rest/getuser.do?uid=abcdx" ;
9
- }
10
9
11
- {
12
10
// GOOD: basic authentication over HTTPS
13
- String url = "https://www.example.com/rest/getuser.do?uid=abcdx" ;
14
- }
11
+ url = "https://www.example.com/rest/getuser.do?uid=abcdx" ;
15
12
16
13
HttpPost post = new HttpPost (url );
17
14
post .setHeader ("Accept" , "application/json" );
18
15
post .setHeader ("Content-type" , "application/json" );
19
-
16
+
20
17
String authString = username + ":" + password ;
21
18
byte [] authEncBytes = Base64 .getEncoder ().encode (authString .getBytes ());
22
19
String authStringEnc = new String (authEncBytes );
@@ -28,15 +25,12 @@ public void testApacheHttpRequest(String username, String password) {
28
25
* Test basic authentication with Java HTTP URL connection.
29
26
*/
30
27
public void testHttpUrlConnection (String username , String password ) {
31
- {
28
+
32
29
// BAD: basic authentication over HTTP
33
30
String urlStr = "http://www.example.com/rest/getuser.do?uid=abcdx" ;
34
- }
35
31
36
- {
37
32
// GOOD: basic authentication over HTTPS
38
- String urlStr = "https://www.example.com/rest/getuser.do?uid=abcdx" ;
39
- }
33
+ urlStr = "https://www.example.com/rest/getuser.do?uid=abcdx" ;
40
34
41
35
String authString = username + ":" + password ;
42
36
String encoding = Base64 .getEncoder ().encodeToString (authString .getBytes ("UTF-8" ));
0 commit comments