Skip to content

Commit eb7de08

Browse files
authored
Document Basic auth header caching, guard against stale copies (#2286)
Motivation: #2267 introduced `Realm.getBasicAuthHeader()` to cache the computed HTTP Basic authorization header on immutable `Realm` instances. Two follow-ups remained: its Javadoc did not clarify that it always generates a Basic header regardless of the configured `AuthScheme`, and there was no test verifying that the cached header is scoped to each `Realm` instance rather than shared across instances. Modification: Update the `Realm.getBasicAuthHeader()` Javadoc to explicitly document that it always encodes credentials as a Basic authorization header, regardless of the configured scheme. Add a test verifying that two distinct `Realm` instances with identical credentials produce equal but distinct cached header instances. Result: The behavior of `Realm.getBasicAuthHeader()` is now explicitly documented, and its per-instance caching is protected by a regression test against accidental cache sharing.
1 parent 9f4926c commit eb7de08

2 files changed

Lines changed: 16 additions & 1 deletion

File tree

client/src/main/java/org/asynchttpclient/Realm.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,8 @@ public int getMaxIterationCount() {
249249

250250
/**
251251
* Returns the lazily computed and cached HTTP Basic authorization header for this immutable realm.
252-
* Concurrent first calls may compute the same value more than once.
252+
* Always encodes {@link #getPrincipal()} and {@link #getPassword()} as a Basic header, regardless
253+
* of {@link #getScheme()}. Concurrent first calls may compute the same value more than once.
253254
*
254255
* @return the Basic authorization header
255256
* @since 3.0.12

client/src/test/java/org/asynchttpclient/util/AuthenticatorUtilsTest.java

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
import static org.junit.jupiter.api.Assertions.assertEquals;
4040
import static org.junit.jupiter.api.Assertions.assertFalse;
4141
import static org.junit.jupiter.api.Assertions.assertNotNull;
42+
import static org.junit.jupiter.api.Assertions.assertNotSame;
4243
import static org.junit.jupiter.api.Assertions.assertNull;
4344
import static org.junit.jupiter.api.Assertions.assertSame;
4445
import static org.junit.jupiter.api.Assertions.assertThrows;
@@ -66,6 +67,19 @@ void preemptiveBasicAuthorizationHeaderIsMemoizedOnRealm() {
6667
assertSame(first, proxy);
6768
}
6869

70+
@Test
71+
void basicAuthHeaderCacheIsNotSharedAcrossRealms() {
72+
Realm realmA = new Realm.Builder("user", "pass")
73+
.setScheme(Realm.AuthScheme.BASIC)
74+
.build();
75+
Realm realmB = new Realm.Builder("user", "pass")
76+
.setScheme(Realm.AuthScheme.BASIC)
77+
.build();
78+
79+
assertEquals(realmA.getBasicAuthHeader(), realmB.getBasicAuthHeader());
80+
assertNotSame(realmA.getBasicAuthHeader(), realmB.getBasicAuthHeader());
81+
}
82+
6983
@Test
7084
void computeBodyHashEmptyBody() throws Exception {
7185
Request request = new RequestBuilder("GET")

0 commit comments

Comments
 (0)