line/armeria

Default `AuthFailureHandler` for basic access authentication

开放

#4,997 创建于 2023年6月29日

 (4 条评论) (0 个反应) (0 位负责人)Java (863 个派生)batch import
good first issueimprovement

仓库指标

星标
 (4,552 个星标)
PR 合并指标
 (平均合并 5天 12小时) (30 天内合并 42 个 PR)

描述

The original default AuthFailureHandler of AuthService returns 401 Unauthorized status without no additional headers. https://github.com/line/armeria/blob/5abd98ae5c1cb747b1c754f44f840a2756fe6c3e/core/src/main/java/com/linecorp/armeria/server/auth/AuthServiceBuilder.java#L42-L47 As the default failed response does not include WWW-Authenticate: "Basic realm="Accessing to ..." header, they only see 401 Unauthorized but no prompt for login.

If basic access authentication is configured, many users usually expect to see a prompt to enter their ID and password by default. However, a prompt is shown only when a custom error response for WWW-Authenticate is explicitly defined.

AuthService
  .builder()
  .addBasicAuth(httpBasicAuthorizer)
  .onFailure((delegate, ctx, req, cause) -> {
    return HttpResponse.of(ResponseHeaders.builder(HttpStatus.UNAUTHORIZED)
                                          .add(HttpHeaderNames.WWW_AUTHENTICATE,
                                            "Basic realm=\"Accessing to the ...\"")
                                          .build());
  }).newDecorator());

I don't see this as a sensible default for basic auth, so I propose to return WWW-Authenticate: "Basic realm="Accessing to ..." header when only basic access authentication is configured to AuthService.

贡献者指南