FULL PRODUCT VERSION :
java version "1.4.2_08"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.2_08-b03)
Java HotSpot(TM) Client VM (build 1.4.2_08-b03, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows 2000 [Version 5.00.2195]

A DESCRIPTION OF THE PROBLEM :
When going through an ISA Server web proxy that requires NTLM Authentication, each request made using HttpURLConnection leaks memory. After enough requests, all available memory will be consumed.

I validated this with both ISA Server 2000 and ISA Server 2003 running on Windows Server 2003.

When I disabled NTLM and enabled Basic authentication, memory was no longer leaked.

Because our application is a long-running process making many requests, we simply can not support NTLM as it will eventually always crash. Therefore, this problem is critical.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Utilizing the code provided, simply execute any request using HttpURLConnection through an ISA Server configured to use Integrated (NTLM) authorization.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
When running the code snippet, we would expect the system memory size of the JVM to eventually stabilize.
ACTUAL -
All available memory will eventually be consumed.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
java.lang.OutOfMemoryError

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
Simple code snippet:
-----------------------------
...
System.getProperties( ).put( "http.proxyHost", proxyHost );
System.getProperties( ).put( "http.proxyPort", String.valueOf( proxyPort ) );
Authenticator.setDefault( new MyAuthenticator( ) );
...
while (true)
{
    URL url = new URL("http://server/path/anything.ext");
    HttpURLConnection urlConnection =
            ( HttpURLConnection ) url.openConnection( );
    int code = urlConnection.getResponseCode( );
    try{Thread.sleep(200);}catch(Exception e){}
}
...
private static class TunnelAuthenticator
        extends Authenticator
{
    protected PasswordAuthentication getPasswordAuthentication( )
    {
        return new PasswordAuthentication( "user", "password".toCharArray( ) );
    }
}

---------- END SOURCE ----------
###@###.### 2005-05-04 12:05:22 GMT