com.sun.net.httpserver.BasicAuthenticator should check whether "realm" is a quoted string

XMLWordPrintable

    • Type: Bug
    • Resolution: Fixed
    • Priority: P4
    • 18
    • Affects Version/s: 6, 18
    • Component/s: core-libs
    • None
    • b23

      The value of the basic authentication realm is defined by RFC 7617 as a free-form string - which therefore may contain quotes.
      The BasicAuthenticator embeds the string directly in the WWW-Authenticate challenge, without escaping any quotes it may contain.

      The API documentation of BasicAuthenticator should either be clarified, or its behavior changed to escape quotes before embedding the realm string in the WWW-Authenticate header value.

            Assignee:
            Julia Boes (Inactive)
            Reporter:
            Daniel Fuchs
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: