line/armeria

Default `AuthFailureHandler` for basic access authentication

Open

#4,997 opened on 2023年6月29日

GitHub で見る
 (4 comments) (0 reactions) (0 assignees)Java (4,552 stars) (863 forks)batch import
good first issueimprovement

説明

The original default AuthFailureHandler of AuthService returns 401 Unauthorized status without no additional headers. https://github.com/line/armeria/blob/5abd98ae5c1cb747b1c754f44f840a2756fe6c3e/core/src/main/java/com/linecorp/armeria/server/auth/AuthServiceBuilder.java#L42-L47 As the default failed response does not include WWW-Authenticate: "Basic realm="Accessing to ..." header, they only see 401 Unauthorized but no prompt for login.

If basic access authentication is configured, many users usually expect to see a prompt to enter their ID and password by default. However, a prompt is shown only when a custom error response for WWW-Authenticate is explicitly defined.

AuthService
  .builder()
  .addBasicAuth(httpBasicAuthorizer)
  .onFailure((delegate, ctx, req, cause) -> {
    return HttpResponse.of(ResponseHeaders.builder(HttpStatus.UNAUTHORIZED)
                                          .add(HttpHeaderNames.WWW_AUTHENTICATE,
                                            "Basic realm=\"Accessing to the ...\"")
                                          .build());
  }).newDecorator());

I don't see this as a sensible default for basic auth, so I propose to return WWW-Authenticate: "Basic realm="Accessing to ..." header when only basic access authentication is configured to AuthService.

コントリビューターガイド