line/armeria

Default `AuthFailureHandler` for basic access authentication

オープン

#4,997 opened on 2023/06/29

 (4 件のコメント) (0 件のリアクション) (0 人の担当者)Java (863 件のフォーク)batch import
good first issueimprovement

Repository metrics

Stars
 (4,552 個のスター)
PR merge metrics
 (平均マージ 5d 12h) (30d で 42 merged PRs)

説明

The original default AuthFailureHandler of AuthService returns 401 Unauthorized status without no additional headers. https://github.com/line/armeria/blob/5abd98ae5c1cb747b1c754f44f840a2756fe6c3e/core/src/main/java/com/linecorp/armeria/server/auth/AuthServiceBuilder.java#L42-L47 As the default failed response does not include WWW-Authenticate: "Basic realm="Accessing to ..." header, they only see 401 Unauthorized but no prompt for login.

If basic access authentication is configured, many users usually expect to see a prompt to enter their ID and password by default. However, a prompt is shown only when a custom error response for WWW-Authenticate is explicitly defined.

AuthService
  .builder()
  .addBasicAuth(httpBasicAuthorizer)
  .onFailure((delegate, ctx, req, cause) -> {
    return HttpResponse.of(ResponseHeaders.builder(HttpStatus.UNAUTHORIZED)
                                          .add(HttpHeaderNames.WWW_AUTHENTICATE,
                                            "Basic realm=\"Accessing to the ...\"")
                                          .build());
  }).newDecorator());

I don't see this as a sensible default for basic auth, so I propose to return WWW-Authenticate: "Basic realm="Accessing to ..." header when only basic access authentication is configured to AuthService.

コントリビューターガイド