sonatype/async-http-client — Issue #63: authorization flow broken
Author: chrisochs
Created: 2012-03-07 19:39:23+00:00
State: open

For most use cases, especially when connecting to any api's, the current flow for authentication is unusable.

Netty and Grizzly adapters do not provide a way to get at the www-authenticate header or otherwise cache auth credentials. That's pretty much a requirement for any high volume traffic using auth.

If you do not have a realm set, netty will create one for you and use it. This makes no sense as its' guaranteed to fail.

In grizzly, if you do not have a realm set, grizzly will just abort. This is also bad because now you have to wait for the future to timeout. In most cases you want to immediately re-send the request with the authorization header, not wait on a timeout.

The correct long term solution IMO is as follows:

If the user doesn't set a realm, don't do anything additional for 401's.

Have a flag to cache the authorization, and an optional expiration on the cache.

A short term solution is to be able to disable 401 handling by the client. That way it's possible to still use AHC while it's auth support is being fixed.