line/armeria

Default `AuthFailureHandler` for basic access authentication

Aperta

#4997 aperta il 29 giu 2023

 (4 commenti) (0 reazioni) (0 assegnatari)Java (863 fork)batch import
good first issueimprovement

Metriche repository

Star
 (4552 stelle)
Metriche merge PR
 (Merge medio 5g 12h) (42 PR mergiate in 30 g)

Descrizione

The original default AuthFailureHandler of AuthService returns 401 Unauthorized status without no additional headers. https://github.com/line/armeria/blob/5abd98ae5c1cb747b1c754f44f840a2756fe6c3e/core/src/main/java/com/linecorp/armeria/server/auth/AuthServiceBuilder.java#L42-L47 As the default failed response does not include WWW-Authenticate: "Basic realm="Accessing to ..." header, they only see 401 Unauthorized but no prompt for login.

If basic access authentication is configured, many users usually expect to see a prompt to enter their ID and password by default. However, a prompt is shown only when a custom error response for WWW-Authenticate is explicitly defined.

AuthService
  .builder()
  .addBasicAuth(httpBasicAuthorizer)
  .onFailure((delegate, ctx, req, cause) -> {
    return HttpResponse.of(ResponseHeaders.builder(HttpStatus.UNAUTHORIZED)
                                          .add(HttpHeaderNames.WWW_AUTHENTICATE,
                                            "Basic realm=\"Accessing to the ...\"")
                                          .build());
  }).newDecorator());

I don't see this as a sensible default for basic auth, so I propose to return WWW-Authenticate: "Basic realm="Accessing to ..." header when only basic access authentication is configured to AuthService.

Guida contributor