具有基本身份验证长密码的httpurlconnection

Question

We are having issue with HttpURLConnection + Basic authentication when we have lengthy passwords.

Here is the sampple code:

URL url = new URL("http://localhost/data.json");
HttpURLConnection conn = (HttpURLConnection) url.openConnection();

conn.setRequestMethod(method);

String authString = clientId + ":" + clientSecret;
BASE64Encoder encoder = new BASE64Encoder();


String authHeader = encoder.encode(authString.getBytes()); 
conn.setRequestProperty("Authorization", authHeader);
conn.setRequestProperty("Accept", "application/json");

We tried to use

     String authString = clientId + ":" + clientSecret;
authString = "" + javax.xml.bind.DatatypeConverter.printBase64Binary(authString.getBytes());

But no luck with this.

HttpURLConnection with Basic Auth with passswords of certain length working fine but with lengthy passwords we have issue. And the error code returned is 400

Note: This is related to Login with Paypal integration https://developer.paypal.com/webapps/developer/docs/integration/direct/log-in-with-paypal/detailed/#making-first-call

and the sample code we have (provided by PayPal) also not working.

thank you in advance.

Answer 1

The issue I faced is due to lengthy username, password.

If I use below code, it works fine

    byte[] encodedBytes = org.apache.commons.codec.binary.Base64.encodeBase64(passwordString.getBytes("UTF-8"));
    String encodedString = new String(encoded, "UTF-8");

and

headers.put("Authorization", "Basic " + encodedString);

Answer 2

Try a POST.

If you are testing this with a local server, make sure it doesn't have any restrictions on max URL size, max parameter length, max POST header size, etc. Check server side logs.

This is likely not the problem, but there is a probable bug in this statement "authString.getBytes()". You are converting the string to bytes based on the system default encoding, which depends on JVM/OS/Locale-- you should pass an explicit encoding to getBytes().

Answer 3

You should inspect a succesful authentication, ie. with a web browser having request inspector (ie. chrome) or just with wireshark.

So you can see what kind of request message is sent to the server.

Starting from that point you can check if your code provides the same kind of request and, if they're not the same, you can at least find what's wrong.

Although even if there's no spec-enforced limit for basic auth lenght, some platform dependent limits still exist as outlined here: Is there a practical HTTP Header length limit?

Hope you find it usefull.