FULL PRODUCT VERSION :
java version "1.5.0_06"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_06-b05)
Java HotSpot(TM) Client VM (build 1.5.0_06-b05, mixed mode, sharing)
ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows XP [Version 5.1.2600]
A DESCRIPTION OF THE PROBLEM :
If you implement a custom java.net.Authenticator and the Password in the PasswordAuthenication object causes the whole username:password string to exceed 76 characters, the Base64Encoder adds a "\n" character.
When an HttpURLConnection tries to use the Authenticator, it fails complaining about the "\n" in the Base64 encoded string.
STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Implement a java.net.Authenticator that returns a long password. By long, I mean that it will blow the 76 character limit of the Base64Encoder. After 76 characters, the Base64Encoder inserts a "\n" character.
Authenticator.setDefault(your authenticator);
Open an HttpURLConnection to a server which requires Basic Auth.
EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
If I workaround by creating my own Base64 string and remove the "\n" character then the Basic Auth succeeds fine.
ACTUAL -
Error message. You can't set a Basic Auth header with a newline character in it.
ERROR MESSAGES/STACK TRACES THAT OCCUR :
Exception in thread "main" java.lang.RuntimeException: java.lang.IllegalArgumentException: Illegal character(s) in message header value: Basic ZGJvZGVuOntsbDEwfWRib2RlbnwxMTU1MDcyNjAzNTQwfDExNTUxMjY5Njk2Njh8dncrSjZZc2Zm
V1BObzdFQnFlZXgyNVE0YThrPQ==
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getHeaderField(Unknown Source)
at java.net.HttpURLConnection.getResponseCode(Unknown Source)
at TokenClientAuthenticator.main(TokenClientAuthenticator.java:16)
Caused by: java.lang.IllegalArgumentException: Illegal character(s) in message header value: Basic ZGJvZGVuOntsbDEwfWRib2RlbnwxMTU1MDcyNjAzNTQwfDExNTUxMjY5Njk2Njh8dncrSjZZc2Zm
V1BObzdFQnFlZXgyNVE0YThrPQ==
at sun.net.www.protocol.http.HttpURLConnection.checkMessageHeader(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.setAuthenticationProperty(Unknown Source)
at sun.net.www.protocol.http.BasicAuthentication.setHeaders(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getServerAuthentication(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
... 2 more
REPRODUCIBILITY :
This bug can be reproduced always.
---------- BEGIN SOURCE ----------
import java.net.Authenticator;
import java.net.HttpURLConnection;
import java.net.PasswordAuthentication;
import java.net.URL;
class TokenClientAuthenticator extends Authenticator {
protected PasswordAuthentication getPasswordAuthentication() {
return new PasswordAuthentication("dboden", "{ll10}dboden|1155072603540|1155126969668|vw+J6YsffWPNo7EBqeex25Q4a8k=".toCharArray());
}
public static void main(String[] args) throws Exception {
Authenticator.setDefault(new TokenClientAuthenticator());
URL url = new URL("http://lolfidsales01:6000/SS/rcp/launch.jnlp"); //change this to a location that requires basic auth
HttpURLConnection con = (HttpURLConnection)url.openConnection();
int responseCode = con.getResponseCode();
System.out.println("Response is " + responseCode);
}
}
---------- END SOURCE ----------
CUSTOMER SUBMITTED WORKAROUND :
Don't use an Authenticator, create the Base64 encoded string and remove the "\n"s.
String encodeMe = m_username + ":" + m_sToken;
BASE64Encoder encoder = new BASE64Encoder();
String base64Encoded = encoder.encode(encodeMe.getBytes());
//!Important! - Get rid of any newline characters erroneously
// added by the Base64Encoder
base64Encoded = base64Encoded.replaceAll("\n", "");
basicAuthCredentialsBase64 = base64Encoded;
java version "1.5.0_06"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_06-b05)
Java HotSpot(TM) Client VM (build 1.5.0_06-b05, mixed mode, sharing)
ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows XP [Version 5.1.2600]
A DESCRIPTION OF THE PROBLEM :
If you implement a custom java.net.Authenticator and the Password in the PasswordAuthenication object causes the whole username:password string to exceed 76 characters, the Base64Encoder adds a "\n" character.
When an HttpURLConnection tries to use the Authenticator, it fails complaining about the "\n" in the Base64 encoded string.
STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Implement a java.net.Authenticator that returns a long password. By long, I mean that it will blow the 76 character limit of the Base64Encoder. After 76 characters, the Base64Encoder inserts a "\n" character.
Authenticator.setDefault(your authenticator);
Open an HttpURLConnection to a server which requires Basic Auth.
EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
If I workaround by creating my own Base64 string and remove the "\n" character then the Basic Auth succeeds fine.
ACTUAL -
Error message. You can't set a Basic Auth header with a newline character in it.
ERROR MESSAGES/STACK TRACES THAT OCCUR :
Exception in thread "main" java.lang.RuntimeException: java.lang.IllegalArgumentException: Illegal character(s) in message header value: Basic ZGJvZGVuOntsbDEwfWRib2RlbnwxMTU1MDcyNjAzNTQwfDExNTUxMjY5Njk2Njh8dncrSjZZc2Zm
V1BObzdFQnFlZXgyNVE0YThrPQ==
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getHeaderField(Unknown Source)
at java.net.HttpURLConnection.getResponseCode(Unknown Source)
at TokenClientAuthenticator.main(TokenClientAuthenticator.java:16)
Caused by: java.lang.IllegalArgumentException: Illegal character(s) in message header value: Basic ZGJvZGVuOntsbDEwfWRib2RlbnwxMTU1MDcyNjAzNTQwfDExNTUxMjY5Njk2Njh8dncrSjZZc2Zm
V1BObzdFQnFlZXgyNVE0YThrPQ==
at sun.net.www.protocol.http.HttpURLConnection.checkMessageHeader(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.setAuthenticationProperty(Unknown Source)
at sun.net.www.protocol.http.BasicAuthentication.setHeaders(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getServerAuthentication(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
... 2 more
REPRODUCIBILITY :
This bug can be reproduced always.
---------- BEGIN SOURCE ----------
import java.net.Authenticator;
import java.net.HttpURLConnection;
import java.net.PasswordAuthentication;
import java.net.URL;
class TokenClientAuthenticator extends Authenticator {
protected PasswordAuthentication getPasswordAuthentication() {
return new PasswordAuthentication("dboden", "{ll10}dboden|1155072603540|1155126969668|vw+J6YsffWPNo7EBqeex25Q4a8k=".toCharArray());
}
public static void main(String[] args) throws Exception {
Authenticator.setDefault(new TokenClientAuthenticator());
URL url = new URL("http://lolfidsales01:6000/SS/rcp/launch.jnlp"); //change this to a location that requires basic auth
HttpURLConnection con = (HttpURLConnection)url.openConnection();
int responseCode = con.getResponseCode();
System.out.println("Response is " + responseCode);
}
}
---------- END SOURCE ----------
CUSTOMER SUBMITTED WORKAROUND :
Don't use an Authenticator, create the Base64 encoded string and remove the "\n"s.
String encodeMe = m_username + ":" + m_sToken;
BASE64Encoder encoder = new BASE64Encoder();
String base64Encoded = encoder.encode(encodeMe.getBytes());
//!Important! - Get rid of any newline characters erroneously
// added by the Base64Encoder
base64Encoded = base64Encoded.replaceAll("\n", "");
basicAuthCredentialsBase64 = base64Encoded;
- duplicates
-
JDK-6947917 Error in basic authentication when user name and password are long
-
- Closed
-