[HtmlUnit] [ htmlunit-Bugs-2558284 ] HTTP Basic Authentication with more than one browser fails

[SourceForge.net <no...@so...>]

Bugs item #2558284, was opened at 2009-02-02 21:16
Message generated for change (Settings changed) made by asnaseer
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=448266&aid=2558284&group_id=47038

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: 2.4
Status: Open
>Resolution: Invalid
Priority: 5
Private: No
Submitted By: Anjum Naseer (asnaseer)
Assigned to: Nobody/Anonymous (nobody)
Summary: HTTP Basic Authentication with more than one browser fails

Initial Comment:
I am using htmlunit v2.4 and am having problems with testing HTTP Basic Authentication against my REST-based web service using two types of browsers.

I am creating my two browsers and credentials as follows:
     final WebClient xhtmlBrowser = new WebClient(BrowserVersion.FIREFOX_2);
     xhtmlBrowser.addRequestHeader("ACCEPT", "text/html,application/xhtml+xml");
     xhtmlBrowser.setRedirectEnabled(true);
     xhtmlBrowser.setUseInsecureSSL(true);

     fiNovember2008
nal WebClient jsonBrowser = new WebClient();
     jsonBrowser.addRequestHeader("ACCEPT", "application/json");
     jsonBrowser.setRedirectEnabled(true);
     jsonBrowser.setUseInsecureSSL(true);

     final DefaultCredentialsProvider userCredentials = new DefaultCredentialsProvider();
     userCredentials.addCredentials("someName", "somePassword");

I then browse to my web service using code like this:
     xhtmlBrowser.setCredentialsProvider(userCredentials);
     final WebResponse xhtmlResponse = xhtmlBrowser.getPage("http://...").getWebResponse();
     ...
     jsonBrowser.setCredentialsProvider(userCredentials);
     final WebResponse jsonResponse = jsonBrowser.getPage("http://...").getWebResponse();
     ...

My web service redirects to an HTTPS URI and requires HTTP Basic Authentication (I am using Suns Jersey product (https://jersey.dev.java.net/) to write my REST-based Web Service).

The first response (xhtmlResponse) comes back all fine and I can process and check that the response is as I expected.
However, the second response (jsonResponse) fails with:
   ...
   ... org.apache.commons.httpclient.auth.AuthChallengeProcessor selectAuthScheme
   INFO: basic authentication scheme selected
   ... org.apache.commons.httpclient.HttpMethodDirector processWWWAuthChallenge
   INFO: No credentials available for BASIC 'SmartInspector'@localhost:8181
   ... com.gargoylesoftware.htmlunit.WebClient printContentIfNecessary
   INFO: statusCode=[401] contentType=[text/html]
   ... com.gargoylesoftware.htmlunit.WebClient printContentIfNecessary
   ... HTTP Status 401 - An Authentication object was not found in the SecurityContext
   ... This request requires HTTP authentication (An Authentication object was not found in the SecurityContext).
   ... Sun Java System Application Server 9.1_02

If I comment out the first request like so:
     // xhtmlBrowser.setCredentialsProvider(userCredentials);
     // final WebResponse xhtmlResponse = xhtmlBrowser.getPage("http://...").getWebResponse();
     // ...
     jsonBrowser.setCredentialsProvider(userCredentials);
     final WebResponse jsonResponse = jsonBrowser.getPage("http://...").getWebResponse();
     ...

Then the second (json) request works just fine. I actually have a list of four different types of browsers that I iterate through to test that my service works against all of them, but I have simplified the example to illustrate the problem.

I get the same problem even if I directly browse to "https://..." thereby avoiding the redirect from http to https by my service.

----------------------------------------------------------------------

>Comment By: Anjum Naseer (asnaseer)
Date: 2009-02-02 23:08

Message:
Sorry - I looked into the error in more detail and found that I cannot
re-use the credentials instance since it gets marked as "answered" by the
underlying httpclient library on the first request. If I create a new
instance of DefaultCredentialsProvider before each request, then it all
works as I expected.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=448266&aid=2558284&group_id=47038