Digest Authentication java.net.http.HttpClient

Question

I'm trying to connect to a website protected with digest authentication. My credentials work fine if I try to log in via Insomnia or Firefox but I fail to get it to work in Java 17 (Insomnia's automatically generated Code also doesn't work).

I tried to follow and understand the following tutorials/docs:

https://www.baeldung.com/java-9-http-client

https://docs.oracle.com/javase/7/docs/technotes/guides/net/http-auth.html

Both mention that Digest is supported, as far as I understand.

The result I get is always status code 401 & the expected header when digest auth fails:

www-authenticate=[Digest realm="api-realm", qop="auth", nonce="NONCE=="

Here is the current code. The method getPasswordAuthentication doesn't get executed:

public void checkIsAPIRunning() {

    HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://the-site-I-try-to-connect-with:443/api/function"))
            .method("GET", HttpRequest.BodyPublishers.noBody()).build();
    HttpResponse<String> response = null;
    try {
        response = HttpClient.newBuilder().authenticator(new Authenticator() {
            @Override
            protected PasswordAuthentication getPasswordAuthentication() {
                return new PasswordAuthentication("user", "pass".toCharArray());
            }
        }).build().send(request, BodyHandlers.ofString());          
    } catch (IOException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } catch (InterruptedException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }

}

Am I misunderstanding the docs? I'd appreciate any help or pointers :)

ron190 · Accepted Answer · 2023-07-23 23:12:03Z

2

You have to implement the handshake algorithm, and I advise to use curl to validate the process first.

I did the implementation following this algorithm:

Call the Digest endpoint: response is 401 with header www-authenticate
Get params realm, qop and nonce from header www-authenticate
Build HA1, HA2, response and digest header Authorization
Call endpoint a second time with the header Authorization
Response should be 200 OK

Digest implementation validated with Spring: https://github.com/ron190/jsql-injection/blob/master/model/src/main/java/com/jsql/util/DigestUtil.java

Inspired by following resources:

answered Jul 23, 2023 at 23:12

ron190

1,1021 gold badge20 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

taranion · Accepted Answer · 2022-12-23 20:12:07Z

1

Digest authentication is not supported directly by the new HttpClient - see here: https://bugs.openjdk.org/browse/JDK-8285888

You are expected to handle the authentication process yourself, it seems.

answered Dec 23, 2022 at 20:12

taranion

6711 gold badge7 silver badges18 bronze badges

Collectives™ on Stack Overflow

Digest Authentication java.net.http.HttpClient

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related