Default `AuthFailureHandler` for basic access authentication
#4,997 opened on 2023年6月29日
説明
The original default AuthFailureHandler of AuthService returns 401 Unauthorized status without no additional headers.
https://github.com/line/armeria/blob/5abd98ae5c1cb747b1c754f44f840a2756fe6c3e/core/src/main/java/com/linecorp/armeria/server/auth/AuthServiceBuilder.java#L42-L47
As the default failed response does not include WWW-Authenticate: "Basic realm="Accessing to ..." header, they only see 401 Unauthorized but no prompt for login.
If basic access authentication is configured, many users usually expect to see a prompt to enter their ID and password by default. However, a prompt is shown only when a custom error response for WWW-Authenticate is explicitly defined.
AuthService
.builder()
.addBasicAuth(httpBasicAuthorizer)
.onFailure((delegate, ctx, req, cause) -> {
return HttpResponse.of(ResponseHeaders.builder(HttpStatus.UNAUTHORIZED)
.add(HttpHeaderNames.WWW_AUTHENTICATE,
"Basic realm=\"Accessing to the ...\"")
.build());
}).newDecorator());
I don't see this as a sensible default for basic auth, so I propose to return WWW-Authenticate: "Basic realm="Accessing to ..." header when only basic access authentication is configured to AuthService.