Java: fetch URL with HTTPBasic Authentication

Question

I'm doing some simple HTTP authentication and am getting a

java.lang.IllegalArgumentException: Illegal character(s) in message header value: Basic OGU0ZTc5ODBk(...trimmed from 76 chars...)
(...more password data...)

which I think is due to me having a really long username and password and the encoder wraps it with a \n at 76 chars. Is there any way I can get around this? The URL only supports HTTP Basic Auth.

Here is my code:

private class UserPassAuthenticator extends Authenticator {
    String user;
    String pass;
    public UserPassAuthenticator(String user, String pass) {
        this.user = user;
        this.pass = pass;
    }

    // This method is called when a password-protected URL is accessed
    protected PasswordAuthentication getPasswordAuthentication() {
        return new PasswordAuthentication(user, pass.toCharArray());
    }
}

private String fetch(StoreAccount account, String path) throws IOException {
    Authenticator.setDefault(new UserPassAuthenticator(account.getCredentials().getLogin(), account.getCredentials().getPassword()));

    URL url = new URL("https", account.getStoreUrl().replace("http://", ""), path);
    System.out.println(url);

    URLConnection urlConn = url.openConnection();
    Object o = urlConn.getContent();
    if (!(o instanceof String)) 
        throw new IOException("Wrong Content-Type on " + url.toString());

    // Remove the authenticator back to the default
    Authenticator.setDefault(null);
    return (String) o;
}

A security notice: if use user name and password via HTTP, both things are send as clear string. Its better to use different authentication (form, POST) and transport protocol (HTTPS, H2). — Mirko Ebert
– Mirko Ebert, Commented Jun 1, 2017 at 12:50

Community · Accepted Answer · 2023-11-10 19:48:45Z

17

That seems to be a bug in Java.

Have you tried using alternative HTTP clients, such as the library from Apache?

Or instead of using the Authenticator, manually setting the header?

URL url = new URL("http://www.example.com/");
HttpURLConnection connection = (HttpURLConnection) url.openConnection();
connection.setRequestProperty("Authorization", "Basic OGU0ZTc5ODBkABcde....");

The token value is encodeBase64("username:password").

edited Nov 10, 2023 at 19:48

CommunityBot

11 silver badge

answered Jan 13, 2010 at 6:02

Thilo

264k107 gold badges527 silver badges674 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Paul Tarjan Over a year ago

Works great as long as I do the fix from your bug post.

String encoding = new sun.misc.BASE64Encoder().encode (userpass.getBytes()); 		// Java bug : http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6459815 		encoding = encoding.replaceAll("\n", "");

. Thanks

Karl the Pagan Over a year ago

A 64 character password still fails for me when authenticating against an Atlassian REST API (like Bamboo). Replacing newlines wasn't enough in my case. Groovy HTTPBuilder and AHC correctly handle the long password.

cbmanica Over a year ago

Thanks, Oracle, for wasting 30 minutes of my time with this idiocy. (Answer upvoted, sincere thanks)

user2862891 · Accepted Answer · 2017-01-09 09:33:40Z

1

This works for me .

HttpsURLConnection con = null; con = (HttpsURLConnection) obj.openConnection(); String encoding = Base64.getEncoder().encodeToString("username:password".getBytes(StandardCharsets.UTF_8)); con.setRequestProperty("Authorization","Basic "+encoding.replaceAll("\n", ""));

answered Jan 9, 2017 at 9:33

user2862891

111 bronze badge

Comments

Jim Jones · Accepted Answer · 2017-06-01 12:44:48Z

0

I found that the illegal character was caused by "Authorization: Basic ", encoded which should be "Authorization", "Basic " + encoded

answered Jun 1, 2017 at 12:44

Jim Jones

11 silver badge6 bronze badges

Comments

Ifte Rana · Accepted Answer · 2020-06-08 05:11:12Z

0

changing from "Authorization: Basic ", encoded to "Authorization", "Basic " + encoded solved my illegal character in header issue.

answered Jun 8, 2020 at 5:11

Ifte Rana

1

Collectives™ on Stack Overflow

Java: fetch URL with HTTPBasic Authentication

4 Answers 4

3 Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

3 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related