Copy other properties when repeating the request. Choose Digest over Basic if the server returns both

Author: alessandro.gherardi

core-client/src/main/java/org/glassfish/jersey/client/authentication/HttpAuthenticationFilter.java

@@ -49,9 +49,9 @@
 import java.util.List;
 import java.util.Map;
 
+import javax.annotation.Priority;
 import javax.ws.rs.Priorities;
 import javax.ws.rs.client.Client;
-import javax.ws.rs.client.ClientBuilder;
 import javax.ws.rs.client.ClientRequestContext;
 import javax.ws.rs.client.ClientRequestFilter;
 import javax.ws.rs.client.ClientResponseContext;
@@ -66,8 +66,6 @@
 import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.Response;
 
-import javax.annotation.Priority;
-
 import org.glassfish.jersey.client.ClientProperties;
 import org.glassfish.jersey.client.internal.LocalizationMessages;
 
@@ -222,16 +220,22 @@ public void filter(ClientRequestContext request, ClientResponseContext response)
         Type result = null; // which authentication is requested: BASIC or DIGEST
         boolean authenticate;
 
+        // If the server requests both BASIC and DIGEST, prefer DIGEST since it's stronger
+        // (see https://tools.ietf.org/html/rfc2617#section-4.6)
         if (response.getStatus() == Response.Status.UNAUTHORIZED.getStatusCode()) {
-            String authString = response.getHeaders().getFirst(HttpHeaders.WWW_AUTHENTICATE);
-            if (authString != null) {
-                final String upperCaseAuth = authString.trim().toUpperCase();
-                if (upperCaseAuth.startsWith("BASIC")) {
-                    result = Type.BASIC;
-                } else if (upperCaseAuth.startsWith("DIGEST")) {
-                    result = Type.DIGEST;
-                } else {
-                    // unknown authentication -> this filter cannot authenticate with this method
+            List<String> authStrings = response.getHeaders().get(HttpHeaders.WWW_AUTHENTICATE);
+            if (authStrings != null) {
+                for (String authString : authStrings) {
+                    final String upperCaseAuth = authString.trim().toUpperCase();
+                    if (result == null && upperCaseAuth.startsWith("BASIC")) {
+                        result = Type.BASIC;
+                    } else if (upperCaseAuth.startsWith("DIGEST")) {
+                        result = Type.DIGEST;
+                    }
+                }
+                 
+                if (result == null) {
+                       // unknown authentication -> this filter cannot authenticate with this method
                     return;
                 }
             }
@@ -292,7 +296,7 @@ private void updateCache(ClientRequestContext request, boolean success, Type ope
      * @param newAuthorizationHeader {@code Authorization} header that should be added to the new request.
      * @return {@code true} is the authentication was successful ({@code true} if 401 response code was not returned;
      * {@code false} otherwise).
-     * @throws IOException
+     * @throws IOException 
      */
     static boolean repeatRequest(ClientRequestContext request, ClientResponseContext response, String newAuthorizationHeader)
             throws IOException{
@@ -304,7 +308,7 @@ static boolean repeatRequest(ClientRequestContext request, ClientResponseContext
             response.getEntityStream().close();
             response.setEntityStream(null);
         }
-
+      
         Client client = request.getClient();
         String method = request.getMethod();
         MediaType mediaType = request.getMediaType();
@@ -328,6 +332,12 @@ static boolean repeatRequest(ClientRequestContext request, ClientResponseContext
 
         builder.property(REQUEST_PROPERTY_FILTER_REUSED, "true");
 
+        // Copy other properties, if any, from the original request
+        for (String propertyName : request.getPropertyNames()) {
+          Object propertyValue = request.getProperty(propertyName);
+          builder.property(propertyName, propertyValue);
+        }
+
         Invocation invocation;
         if (request.getEntity() == null) {
             invocation = builder.build(method);