rburgst/okhttp-digest

Authenticator should be selected according to their priority

alexeyvasilyev opened this issue · 2 comments

alexeyvasilyev commented

ISSUE
If basic and digest authenticators specified (see code below), basic one (not secured one) is used always if web server supports both basic and digest authentications.

DispatchingAuthenticator authenticator = new DispatchingAuthenticator.Builder()
.with("digest", digestAuthenticator)
.with("basic", basicAuthenticator)
.build();

EXAMPLE
GET /Streaming/Channels/1/picture HTTP/1.1
Host: 192.168.1.4:1140
Connection: Keep-Alive

HTTP/1.1 401 Unauthorized
Date: Mon, 08 Aug 2016 17:28:03 GMT
Server: App-webs/
Content-Length: 275
Content-Type: text/html
Connection: close
WWW-Authenticate: Digest qop="auth", realm="DS-2CD2432F-IW", nonce="4d6a6c4551305a43515449364e6d497a4d6a63314e546b3d", stale="FALSE"
WWW-Authenticate: Basic realm="DS-2CD2432F-IW"

[data skipped]

GET /Streaming/Channels/1/picture HTTP/1.1
Authorization: Basic YWRtaW46dGVzdA==
Host: 192.168.1.4:1140
Connection: Keep-Alive

HTTP/1.1 200 OK
Content-Type: image/jpeg; charset="UTF-8"
Content-Length:131764

[data skipped]

The issue is that authenticate(...) method in DispatchingAuthenticator selects authenticator according to it's key value in hashmap authenticatorRegistry.

FIX
authenticatorRegistry in DispatchingAuthenticator class should be of type LinkedHashMap instead of HashMap.

alexeyvasilyev commented

This is a bug in okhttp HttpHeaders.parseChallenges(). Will post an issue there.