Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8194729

Java 9's HttpClient doesn't allow custom "Authorization" headers

    Details

    • Subcomponent:
    • CPU:
      x86_64
    • OS:
      os_x

      Description

      FULL PRODUCT VERSION :
      java version "9.0.1"
      Java(TM) SE Runtime Environment (build 9.0.1+11)
      Java HotSpot(TM) 64-Bit Server VM (build 9.0.1+11, mixed mode)

      ADDITIONAL OS VERSION INFORMATION :
      Darwin ms2.judepereira.com 17.2.0 Darwin Kernel Version 17.2.0: Mon Sep 18 15:44:59 PDT 2017; root:xnu-4570.20.55~19/RELEASE_X86_64 x86_64

      A DESCRIPTION OF THE PROBLEM :
      According to the spec, the "authorization" header can have various values. However, the only one Java 9's HttpClient supports is "basic".

      If I set a custom "authorization" header as follows, HttpClient ignores it completely:
      HttpRequest.newBuilder().header("authorization", "bearer " + token);

      The cause is that when it creates the immutable map for user headers, it checks a list called ALLOWED_HEADERS (jdk.incubator.http.internal.common.Utils#ALLOWED_HEADERS).
      This list contains "authorization" as a forbidden user header. Therefore, it prevents any custom "authorization" header other than "basic".

      REGRESSION. Last worked in version 8u152

      ADDITIONAL REGRESSION INFORMATION:
      It's possible in using HttpsUrlConnection as follows:
      HttpsURLConnection#setRequestProperty("authorization", "bearer " + token)

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      It's a flaw in the implementation itself.

      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
      When I set a custom authorization header, it must be respected.
      ACTUAL -
      The authorization header is removed.

      REPRODUCIBILITY :
      This bug can be reproduced always.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                dfuchs Daniel Fuchs
                Reporter:
                webbuggrp Webbug Group
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: