{"id":6,"date":"2009-07-10T16:48:34","date_gmt":"2009-07-10T15:48:34","guid":{"rendered":"http:\/\/www.flamingpenguin.co.uk\/blog\/?p=6"},"modified":"2009-07-10T19:55:20","modified_gmt":"2009-07-10T18:55:20","slug":"bug-in-httpbasicauthfilter","status":"publish","type":"post","link":"https:\/\/www.flamingpenguin.co.uk\/blog\/2009\/07\/10\/bug-in-httpbasicauthfilter\/","title":{"rendered":"Bug in HTTPBasicAuthFilter"},"content":{"rendered":"<p><code>com.sun.jersey.api.client.filter.HTTPBasicAuthFilter<\/code> incorrectly pads the Base64 encoded strings with null characters, instead of &#8216;=&#8217;. jersey-client-1.0.3.jar<\/p>\n<p>It might be better to use a pre-exisiting Base64 library. Like the one in CommonsCodec.<\/p>\n<pre lang=\"java\">public class HttpBasicFilter extends ClientFilter\r\n{\r\n   private static final String c_base64code = \"ABCDEFGHIJKLMNOPQRSTUVWXYZ\" +\r\n                                              \"abcdefghijklmnopqrstuvwxyz0123456789+\/\";\r\n\r\n   private final String m_authentication;\r\n\r\n   \/**\r\n    * Adds an authentication header using a username and password\r\n    *\r\n    * @param username the user name to send\r\n    * @param password the passowrd to send\r\n    *\/\r\n   public HttpBasicFilter(final String username, final String password)\r\n   {\r\n      m_authentication = \"Basic \" + encode(username + \":\" + password);\r\n   }\r\n\r\n   private String encode(final String string)\r\n   {\r\n      byte[] bytes = getBytes(string);\r\n      final int padding = (3 - (bytes.length % 3)) % 3;\r\n\r\n      bytes = zeroPad(bytes.length + padding, bytes);\r\n\r\n      final StringBuilder encoded = new StringBuilder();\r\n      for (int i = 0; i &lt; bytes.length; i += 3)\r\n      {\r\n         final int threeBytes = (bytes[i] &lt;&lt; 16) + (bytes[i + 1] &lt;&lt; 8) + bytes[i + 2];\r\n         encoded.append(c_base64code.charAt((threeBytes &gt;&gt; 18) &amp; 0x3f)).\r\n                 append(c_base64code.charAt((threeBytes &gt;&gt; 12) &amp; 0x3f)).\r\n                 append(c_base64code.charAt((threeBytes &gt;&gt; 6) &amp; 0x3f)).\r\n                 append(c_base64code.charAt(threeBytes &amp; 0x3f));\r\n      }\r\n      return encoded.substring(0, encoded.length() - padding) + \"==\".substring(0, padding);\r\n   }\r\n\r\n   private byte[] getBytes(final String string)\r\n   {\r\n      byte[] bytes;\r\n      try\r\n      {\r\n         bytes = string.getBytes(\"UTF-8\");\r\n      }\r\n      catch (final UnsupportedEncodingException e)\r\n      {\r\n         g_logger.log(Level.WARNING, \"unable to decode string as UTF-8\", e);\r\n         bytes = string.getBytes();\r\n      }\r\n      return bytes;\r\n   }\r\n\r\n   private byte[] zeroPad(final int length, final byte[] bytes)\r\n   {\r\n      final byte[] padded = new byte[length];\r\n      System.arraycopy(bytes, 0, padded, 0, bytes.length);\r\n      return padded;\r\n   }\r\n\r\n   \/**\r\n    * {@inheritDoc}\r\n    *\/\r\n   @Override\r\n   public ClientResponse handle(final ClientRequest request) throws ClientHandlerException\r\n   {\r\n      if (!request.getMetadata().containsKey(HttpHeaders.AUTHORIZATION))\r\n      {\r\n         request.getMetadata().add(HttpHeaders.AUTHORIZATION, m_authentication);\r\n      }\r\n      return getNext().handle(request);\r\n   }\r\n}\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>com.sun.jersey.api.client.filter.HTTPBasicAuthFilter incorrectly pads the Base64 encoded strings with null characters, instead of &#8216;=&#8217;. jersey-client-1.0.3.jar It might be better to use a pre-exisiting Base64 library. Like the one in CommonsCodec. public class HttpBasicFilter extends ClientFilter { private static final String c_base64code &hellip; <a href=\"https:\/\/www.flamingpenguin.co.uk\/blog\/2009\/07\/10\/bug-in-httpbasicauthfilter\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[9],"class_list":["post-6","post","type-post","status-publish","format-standard","hentry","category-java","tag-jersey"],"_links":{"self":[{"href":"https:\/\/www.flamingpenguin.co.uk\/blog\/wp-json\/wp\/v2\/posts\/6","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.flamingpenguin.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.flamingpenguin.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.flamingpenguin.co.uk\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.flamingpenguin.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=6"}],"version-history":[{"count":0,"href":"https:\/\/www.flamingpenguin.co.uk\/blog\/wp-json\/wp\/v2\/posts\/6\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.flamingpenguin.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=6"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.flamingpenguin.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=6"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.flamingpenguin.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=6"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}