Package org.asynchttpclient.util

Class AuthenticatorUtils

java.lang.Object

org.asynchttpclient.util.AuthenticatorUtils

public final class AuthenticatorUtils
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
static String	NEGOTIATE

Method Summary

Modifier and Type	Method	Description
static String	computeBodyHash(Request request, Realm realm)
static @Nullable String	computeExpectedRspAuth(Realm realm, String sentCredentials)	RFC 7616 Section 3.5: the rspauth an honest server must have sent, computed over the Digest credentials this client actually put on the wire.
static String	computeRealmURI(Uri uri, boolean useAbsoluteURI, boolean omitQuery)	The value of the Digest uri auth-param (RFC 7616 Section 3.4).
static @Nullable String	getHeaderWithPrefix(@Nullable List<String> authenticateHeaders, String prefix)
static @Nullable String	perConnectionAuthorizationHeader(Request request, @Nullable ProxyServer proxyServer, @Nullable Realm realm)
static @Nullable String	perConnectionProxyAuthorizationHeader(Request request, @Nullable Realm proxyRealm)
static @Nullable String	perRequestAuthorizationHeader(Request request, @Nullable Realm realm)
static @Nullable String	perRequestProxyAuthorizationHeader(Request request, @Nullable Realm proxyRealm)
static @Nullable String	selectBestDigestChallenge(@Nullable List<String> authenticateHeaders)	RFC 7616 Section 4: Select the best Digest challenge from the list.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

NEGOTIATE

public static final String NEGOTIATE

See Also:

Constant Field Values

Method Detail

getHeaderWithPrefix

@Nullable
public static @Nullable String getHeaderWithPrefix(@Nullable
                                                   @Nullable List<String> authenticateHeaders,
                                                   String prefix)

selectBestDigestChallenge

@Nullable
public static @Nullable String selectBestDigestChallenge(@Nullable
                                                         @Nullable List<String> authenticateHeaders)

RFC 7616 Section 4: Select the best Digest challenge from the list. Iterates in server preference order and returns the first challenge whose algorithm is supported.

computeRealmURI

public static String computeRealmURI(Uri uri,
                                     boolean useAbsoluteURI,
                                     boolean omitQuery)

The value of the Digest uri auth-param (RFC 7616 Section 3.4). It is the Effective Request URI (RFC 7230 Section 5.5), which never carries the deprecated userinfo subcomponent, so render the absolute form without it: the credentials would otherwise be spelled out in cleartext in the Authorization header on the very hop Digest exists to keep them off, and the value would disagree with the absolute-form request line that RFC 7616 Section 3.4.6 has servers verify it against.

computeExpectedRspAuth

@Nullable
public static @Nullable String computeExpectedRspAuth(Realm realm,
                                                      String sentCredentials)

RFC 7616 Section 3.5: the rspauth an honest server must have sent, computed over the Digest credentials this client actually put on the wire.

The rspauth signs the parameters of the request it answers, and none of them can be read back off the Realm. The realm on the response future is rebuilt for header emission (see perRequestAuthorizationHeader(org.asynchttpclient.Request, org.asynchttpclient.Realm)), and every Realm.Builder.build() regenerates the cnonce; its uri is whatever the exchange started with, which a redirect or a preemptive first request leaves stale or unset. So parse the credentials header instead and use the realm only for the secret and the charset.

Parameters:

sentCredentials - the Authorization or Proxy-Authorization header value sent with the request being answered

Returns:

the expected rspauth, or null when it cannot be derived — no Digest credentials were sent (a CONNECT is answered before any are), the header is missing parameters, the algorithm is unsupported, or qop=auth-int signs a response body that has not arrived yet. Callers must then skip verification rather than enforce a value known to be wrong.

computeBodyHash

public static String computeBodyHash(Request request,
                                     Realm realm)

perConnectionProxyAuthorizationHeader

@Nullable
public static @Nullable String perConnectionProxyAuthorizationHeader(Request request,
                                                                     @Nullable
                                                                     @Nullable Realm proxyRealm)

perRequestProxyAuthorizationHeader

@Nullable
public static @Nullable String perRequestProxyAuthorizationHeader(Request request,
                                                                  @Nullable
                                                                  @Nullable Realm proxyRealm)

perConnectionAuthorizationHeader

@Nullable
public static @Nullable String perConnectionAuthorizationHeader(Request request,
                                                                @Nullable
                                                                @Nullable ProxyServer proxyServer,
                                                                @Nullable
                                                                @Nullable Realm realm)

perRequestAuthorizationHeader

@Nullable
public static @Nullable String perRequestAuthorizationHeader(Request request,
                                                             @Nullable
                                                             @Nullable Realm realm)