Java Apache httpdelete-400错误

Question

I am having difficulty pinpointing where the BAD response is coming from, I have performed the request in the below Java code but also as a DELETE REST call from the SOAP UI where I am getting a successful 200 response. (The call is identical)

The below code is designed to login & logout of the session by setting cookies - then passing them into the delete call as a header

Java Code

import java.io.BufferedReader;
import java.io.InputStreamReader;

import org.apache.http.Header;
import org.apache.http.HttpHost;
import org.apache.http.HttpResponse;
import org.apache.http.client.config.RequestConfig;
import org.apache.http.client.methods.HttpDelete;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.entity.StringEntity;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;

public class testing {

    public static void main(String[] args) throws Exception {

        HttpResponse httpResponse = null;

        CloseableHttpClient httpclient = HttpClients.createDefault();

        RequestConfig requestConfig = RequestConfig.copy(RequestConfig.DEFAULT)
                .setProxy(new HttpHost("xxx.xxx.xxx.xxx", 8080))
                .build();

        HttpHost target = new HttpHost("https://xxxxxxxxx.xxxxxxxxx.com");

        HttpPost post = new HttpPost("https://xxxxxxxxx.xxxxxxxxx.com/authentications/emails");

        post.setConfig(requestConfig);

        post.addHeader("Accept-Language","en-GB");
        post.addHeader("X-ApiKey","xxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxxxxxxx");
        post.addHeader("Content-Type", "application/json");


        StringEntity input = new StringEntity("{\"Password\":\"xxxxxxxxx\",\"Email\":\"xxxxxxxxx.xxxxxxxxx@xxxxxxxxx.com\"}");
        input.setContentType("application/json");
        post.setEntity(input);

        httpResponse = httpclient.execute(target, post);

        Header[] headers = httpResponse.getAllHeaders();

        for (Header header: headers)
        {
            System.out.println(header.getName() + ": " + header.getValue());
        }

        String[] ss_id_list = headers[10].getValue().split(";");
        String ss_id = ss_id_list[0];
        String[] ss_pid_list = headers[11].getValue().split(";");
        String ss_pid = ss_pid_list[0];

        HttpDelete call = new HttpDelete("https://xxxxxxxxx-xxxxxxxxx.xxxxxxxxx.com/authentications/current");

        call.setConfig(requestConfig);

        call.setHeader("Accept-Language","en-GB");
        call.setHeader("X-ApiKey","xxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxxxxxxx");
        call.setHeader("Cookie", ss_id +";"+ ss_pid +"; ss-opt=temp; X-UAId=xxxxxxxxx;");
        call.setHeader("Content-Type", "application/x-www-form-urlencoded");

        Header[] rheaders = call.getAllHeaders();

        System.out.println(call.toString());
        for (Header rheader : rheaders) {
            System.out.println(rheader.getName() + ": " + rheader.getValue());
        }

        httpResponse = httpclient.execute(target, call);

        BufferedReader br = new BufferedReader(new InputStreamReader((httpResponse.getEntity().getContent())));

        StringBuilder content = new StringBuilder();
        String line;
        while (null != (line = br.readLine())) {
            content.append(line);
        }

        System.out.println(httpResponse.getStatusLine());

        httpclient.close();

    }





}

Java Request & Response

Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin: *
Cache-Control: private
Content-Type: application/json; charset=utf-8
Date: Thu, 13 Oct 2016 10:33:21 GMT
X-Frame-Options: SAMEORIGIN
X-Request-Identifier: xxxxxxxxx
Proxy-Connection: Keep-Alive
Connection: Keep-Alive
Set-Cookie: ss-id=xxxxxxxxx; path=/; HttpOnly
Set-Cookie: ss-pid=xxxxxxxxx; expires=Mon, 13-Oct-2036 10:33:21 GMT; path=/; HttpOnly
Set-Cookie: ss-opt=temp; expires=Mon, 13-Oct-2036 10:33:21 GMT; path=/; HttpOnly
Set-Cookie: X-UAId=xxxxxxxxx; expires=Mon, 13-Oct-2036 10:33:21 GMT; path=/; HttpOnly


DELETE https://xxxxxxxxx.xxxxxxxxx.com/authentications/current HTTP/1.1
Accept-Language: en-GB
X-ApiKey: xxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxxxxxxx
Cookie: ss-id=xxxxxxxxx;ss-pid=xxxxxxxxx; ss-opt=temp; X-UAId=xxxxxxxxx;
Content-Type: application/x-www-form-urlencoded
HTTP/1.1 400 Bad Request

SOAP UI Request

DELETE https://xxxxxxxxx.xxxxxxxxx.com/authentications/current HTTP/1.1
Accept-Encoding: gzip,deflate
X-ApiKey: xxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxxxxxxx
Accept-Language: en-GB
Cookie: ss-id=xxxxxxxxx;ss-pid=xxxxxxxxx; ss-opt=temp; X-UAId=xxxxxxxxx;
Content-Type: text/html
Content-Length: 0
Host: xxxxxxxxx.xxxxxxxxx.com
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)

SOAP UI Response

HTTP/1.1 200 OK
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin: *
Cache-Control: private
Content-Encoding: gzip
Content-Type: application/json; charset=utf-8
Date: Thu, 13 Oct 2016 10:15:29 GMT
X-Frame-Options: SAMEORIGIN
X-Request-Identifier: xxxxxxxxx
Content-Length: 59
Connection: keep-alive

{"IsNewUser":false,"ResponseStatus":{}}

I apologize for the dump of code & responses is there something obvious in the Java code I am missing. Both Java solution & SOAP UI are using Same PROXY server for this request.

Answer 1

It turns out the offending line is:

HttpHost target = new HttpHost("https://xxxxxxxxx.xxxxxxxxx.com");

Doing this however with HTTPS connections causes No trusted certificate found Exception errors.

I have found lots of answers about implementing a Trust Manager & Host Name verifier but not for Apache httpclient (This works with v4.3)

TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
    public java.security.cert.X509Certificate[] getAcceptedIssuers() {
        return null;
    }
    public void checkClientTrusted(X509Certificate[] certs, String authType) {
    }
    public void checkServerTrusted(X509Certificate[] certs, String authType) {
    }
} };

// Install the all-trusting trust manager
final SSLContext sc = SSLContext.getInstance("TLS");
sc.init(null, trustAllCerts, new java.security.SecureRandom());
SSLConnectionSocketFactory sslConnectionFactory = new SSLConnectionSocketFactory(sc, SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

// Create all-trusting host name verifier
X509HostnameVerifier allHostsValid = new X509HostnameVerifier() {
    public boolean verify(String hostname, SSLSession session) {
        return true;
    }

    public void verify(String arg0, SSLSocket arg1) throws IOException {
        //Not Required Auto-generated method stub from X509HostnameVerifier

    }

    public void verify(String arg0, X509Certificate arg1) throws SSLException {
        //Not Required Auto-generated method stub from X509HostnameVerifier

    }

    public void verify(String arg0, String[] arg1, String[] arg2) throws SSLException {
        //Not Required Auto-generated method stub from X509HostnameVerifier

    }
};
CloseableHttpClient httpclient = HttpClients.custom()
        .setSSLSocketFactory(sslConnectionFactory)
        .setHostnameVerifier(allHostsValid)
        .build();