HttpURLConnection response shows as Unauthorized

Question

Background:

We have a Desktop Java based app which calls an ASPX page hosted in a different server which doesn't need authentication.

Trials done:

• I found this app started getting unauthorized/401 after JRE updated to 1.8.0_201; When I switch this back to JRE 1.8.0_141 everything works fine.

• I have fired the same using RESTClient; I see that the request has been sent to the website.

  Code example:

    //Create connection url = new URL(targetURL); connection = (HttpURLConnection)url.openConnection(); connection.setRequestMethod("POST"); connection.setRequestProperty("Content-Type", "application/xml"); connection.setRequestProperty("Content-Language", "en-US"); connection.setUseCaches (false); connection.setDoInput(true); connection.setDoOutput(true); OutputStreamWriter out; out = new OutputStreamWriter(connection.getOutputStream()); out.write("<?xml version=\\"1.0\\"?>\\r\\n"); out.write("<methodCall>\\r\\n"); out.write(" <project>" + "<![CDATA["+"Pla"+"]]>" + "</project>\\r\\n"); out.write("</methodCall>\\r\\n"); 

Exact error:

java.io.IOException: Server returned HTTP response code: 401 for URL:
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
    at java.lang.reflect.Constructor.newInstance(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection$10.run(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection$10.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)

Could you please help me solve this problem?

---

Below is some content for both JREs: JRE_1.8.0_201: Mar 27, 2019 1:20:45 PM sun.net.www.protocol.http.HttpURLConnection getServerAuthentication FINER: Server Authentication for AuthenticationHeader: prefer NTLM returned null

JRE_1.8.0_131: ar 27, 2019 11:28:35 AM sun.net.www.protocol.http.HttpURLConnection getServerAuthentication FINER: Server Authentication for AuthenticationHeader: prefer NTLM returned sun.net.www.protocol.http.ntlm.NTLMAuthentication@728938a9 Mar 27, 2019 11:28:35 AM sun.net.www.protocol.http.HttpURLConnection plainConnect0

Answer 1

I suggest you check the value of the User-Agent header. Try setting it to "Mozilla/5.0" for example.

Answer 2

We've had a similar problem with HttpURLConnection and this specific 1.8.0_201 jre with failing authentication and a "Authentication: Basic xxyyy" header. Our scenario was that the server first answered with a "301 moved permanently" and the httpurlconnection correctly retried the request with the new provided url, but the "Authentication" header was missing so we ran against a 401.

Fun fact: When setting the the header like this:

connection.setRequestProperty("Authorization ", "Basic " + authString);

(see the additional space after the header name) it worked, so I believe the filter for the "Authentication" header is a intended behaviour, and bad implemented ;-)