如何阻止Okhttp Authenticator被多次调用？

Question

I have an Authenticator like this

@Singleton
class TokenAutheticator @Inject constructor(private val tokenHolder: Lazy<TokenHolder>,private val tokenInterceptor: TokenInterceptor):Authenticator {
    override fun authenticate(route: Route?, response: Response): Request? {

        val resp = tokenHolder.get().tokenService.relogin(tokenInterceptor.token).execute()
        println("### res "+resp.code())
        if (resp.code()==200) {
            val body = tokenHolder.get().tokenService.relogin(tokenInterceptor.token).execute()?.body()

            val newToken = body?.token
            println("########## authenticator ########## ")
            val url = route?.address()?.url()?.newBuilder()?.addQueryParameter("token", newToken)?.build()


            return response.request().newBuilder().url(url).build()
        }else{
            return null
        }
    }


}

When the resp.code != 200 the Authenticator is called multiple times. I am plugging it in Okhttp like this

@Provides
@Singleton
fun provideOkhttp(tokenInterceptor: TokenInterceptor, tokenAutheticator: TokenAutheticator): OkHttpClient {

    val logging = HttpLoggingInterceptor()
    logging.setLevel(HttpLoggingInterceptor.Level.BODY)
    val client = OkHttpClient.Builder()

            .authenticator(tokenAutheticator)
            .addInterceptor(logging)
            .addInterceptor(tokenInterceptor)
            .build()

    return client
}

So what I want to do is have the Authenticator try it only once and if it is able to get a new token then use the new token from now on and if it can't get a new token then exit. But the Authenticator is called multiple times and the API responds with Too many attempts. Any help is appreciated. Thanks

Answer 1

Only when you return null , Authenticator will stop getting called (stop retrying authentication).

Since you always return something, when response code is 200, it will get called a few times. Luckily, as far I understand, Authenticator detects your endless loop, and breaks out of it eventually.

Basically, you should use Authenticator to react to 401 (and similar) response code and only add authorization header in that case.