Class DigestScheme

java.lang.Object
org.apache.hc.client5.http.impl.auth.DigestScheme
All Implemented Interfaces:
Serializable, AuthScheme
public class DigestScheme extends Object implements AuthScheme, Serializable
Digest authentication scheme. Both MD5 (default) and MD5-sess are supported. Currently only qop=auth or no qop is supported. qop=auth-int is unsupported. If auth and auth-int are provided, auth is used.

Since the digest username is included as clear text in the generated Authentication header, the charset of the username must be compatible with the HTTP element charset used by the connection.

Since:
4.0
See Also:

  • Field Details

    • serialVersionUID

      private static final long serialVersionUID
      See Also:

    • LOG

      private static final org.slf4j.Logger LOG

    • HEXADECIMAL

      private static final char[] HEXADECIMAL
      Hexa values used when creating 32 character long digest in HTTP DigestScheme in case of authentication.
      See Also:

    • defaultCharset

      private transient Charset defaultCharset

    • paramMap

      private final Map<String,String> paramMap

    • complete

      private boolean complete

    • buffer

      private transient ByteArrayBuilder buffer

    • userhashSupported

      private boolean userhashSupported
      Flag indicating whether username hashing is supported.

      This flag is used to determine if the server supports hashing of the username as part of the Digest Access Authentication process. When set to true, the client is expected to hash the username using the same algorithm used for hashing the credentials. This is in accordance with Section 3.4.4 of RFC 7616.

      The default value is false, indicating that username hashing is not supported. If the server requires username hashing (indicated by the userhash parameter in the a header set to true), this flag should be set to true to comply with the server's requirements.

    • lastNonce

      private String lastNonce

    • nounceCount

      private long nounceCount

    • cnonce

      private String cnonce

    • a1

      private byte[] a1

    • a2

      private byte[] a2

    • credentials

      private UsernamePasswordCredentials credentials

  • Constructor Details

    • DigestScheme

      public DigestScheme()

    • DigestScheme

      @Deprecated public DigestScheme(Charset charset)
      Deprecated.
      This constructor is deprecated to enforce the use of StandardCharsets.UTF_8 encoding in compliance with RFC 7616 for HTTP Digest Access Authentication. Use the default constructor DigestScheme() instead.
      Parameters:
      charset - the Charset set to be used for encoding credentials. This parameter is ignored as UTF-8 is always used.

  • Method Details

    • initPreemptive

      public void initPreemptive(Credentials credentials, String cnonce, String realm)

    • getName

      public String getName()
      Description copied from interface: AuthScheme
      Returns textual designation of the given authentication scheme.
      Specified by:
      getName in interface AuthScheme
      Returns:
      the name of the given authentication scheme

    • isConnectionBased

      public boolean isConnectionBased()
      Description copied from interface: AuthScheme
      Determines if the authentication scheme is expected to provide an authorization response on a per connection basis instead of the standard per request basis
      Specified by:
      isConnectionBased in interface AuthScheme
      Returns:
      true if the scheme is connection based, false if the scheme is request based.

    • getRealm

      public String getRealm()
      Description copied from interface: AuthScheme
      Returns authentication realm. If the concept of an authentication realm is not applicable to the given authentication scheme, returns null.
      Specified by:
      getRealm in interface AuthScheme
      Returns:
      the authentication realm

    • processChallenge

      public void processChallenge(AuthChallenge authChallenge, org.apache.hc.core5.http.protocol.HttpContext context) throws MalformedChallengeException
      Description copied from interface: AuthScheme
      Processes the given auth challenge. Some authentication schemes may involve multiple challenge-response exchanges. Such schemes must be able to maintain internal state when dealing with sequential challenges

      Please note auth schemes that perform mutual authentication must implement AuthScheme.processChallenge(HttpHost, boolean, AuthChallenge, HttpContext) and AuthScheme.isChallengeExpected() instead.

      Specified by:
      processChallenge in interface AuthScheme
      Parameters:
      authChallenge - the auth challenge
      context - HTTP context
      Throws:
      MalformedChallengeException - in case the auth challenge is incomplete, malformed or otherwise invalid.
      See Also:

    • isChallengeComplete

      public boolean isChallengeComplete()
      Description copied from interface: AuthScheme
      Authentication process may involve a series of challenge-response exchanges. This method tests if the authorization process has been fully completed (either successfully or unsuccessfully), that is, all the required authorization challenges have been processed in their entirety.

      Please note if the scheme returns true from this method in response to a challenge, it effectively implies a failure to respond to this challenge and termination of the authentication process.

      Specified by:
      isChallengeComplete in interface AuthScheme
      Returns:
      true if the authentication process has been completed, false otherwise.

    • isResponseReady

      public boolean isResponseReady(org.apache.hc.core5.http.HttpHost host, CredentialsProvider credentialsProvider, org.apache.hc.core5.http.protocol.HttpContext context) throws AuthenticationException
      Description copied from interface: AuthScheme
      Determines whether or not an authorization response can be generated based on the actual authentication state. Generally the outcome of this method will depend upon availability of user credentials necessary to produce an authorization response.
      Specified by:
      isResponseReady in interface AuthScheme
      Parameters:
      credentialsProvider - The credentials to be used for authentication
      context - HTTP context
      Returns:
      true if an authorization response can be generated and the authentication handshake can proceed, false otherwise.
      Throws:
      AuthenticationException - if authorization string cannot be generated due to an authentication failure

    • getPrincipal

      public Principal getPrincipal()
      Description copied from interface: AuthScheme
      Returns Principal whose credentials are used to generate an authentication response. Connection based schemes are required to return a user Principal if authorization applies to for the entire life span of connection.
      Specified by:
      getPrincipal in interface AuthScheme
      Returns:
      user principal
      See Also:

    • generateAuthResponse

      public String generateAuthResponse(org.apache.hc.core5.http.HttpHost host, org.apache.hc.core5.http.HttpRequest request, org.apache.hc.core5.http.protocol.HttpContext context) throws AuthenticationException
      Description copied from interface: AuthScheme
      Generates an authorization response based on the current state. Some authentication schemes may need to load user credentials required to generate an authorization response from a CredentialsProvider prior to this method call.
      Specified by:
      generateAuthResponse in interface AuthScheme
      Parameters:
      request - The request being authenticated
      context - HTTP context
      Returns:
      authorization header
      Throws:
      AuthenticationException - if authorization string cannot be generated due to an authentication failure
      See Also:

    • createMessageDigest

      private static MessageDigest createMessageDigest(String digAlg) throws UnsupportedDigestAlgorithmException
      Throws:
      UnsupportedDigestAlgorithmException

    • createDigestResponse

      private String createDigestResponse(org.apache.hc.core5.http.HttpRequest request) throws AuthenticationException
      Throws:
      AuthenticationException

    • getNonce

      @Internal public String getNonce()

    • getNounceCount

      @Internal public long getNounceCount()

    • getCnonce

      @Internal public String getCnonce()

    • getA1

      String getA1()

    • getA2

      String getA2()

    • formatHex

      static String formatHex(byte[] binaryData)
      Encodes a byte array digest into a hexadecimal string.

      This method supports digests of various lengths, such as 16 bytes (128-bit) for MD5, 32 bytes (256-bit) for SHA-256, and SHA-512/256. Each byte is converted to two hexadecimal characters, so the resulting string length is twice the byte array length.

      Parameters:
      binaryData - the array containing the digest bytes
      Returns:
      encoded hexadecimal string, or null if encoding failed

    • createCnonce

      static byte[] createCnonce(DigestScheme.DigestAlgorithm algorithm)
      Creates a random cnonce value based on the specified algorithm's expected entropy. Adjusts the length of the byte array based on the algorithm to ensure sufficient entropy.
      Parameters:
      algorithm - the algorithm for which the cnonce is being generated (e.g., "MD5", "SHA-256", "SHA-512-256").
      Returns:
      The cnonce value as a byte array.
      Since:
      5.5

    • writeObject

      private void writeObject(ObjectOutputStream out) throws IOException
      Throws:
      IOException

    • readObject

      private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException
      Throws:
      IOException
      ClassNotFoundException

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • containsInvalidABNFChars

      private boolean containsInvalidABNFChars(String value)
      Checks if a given string contains characters that are not allowed in an ABNF quoted-string as per standard specifications.

      The method checks for: - Control characters (ASCII 0x00 to 0x1F and 0x7F). - Characters outside the printable ASCII range (above 0x7E). - Double quotes (") and backslashes (\), which are not allowed.

      Parameters:
      value - The string to be checked for invalid ABNF characters.
      Returns:
      true if invalid characters are found, false otherwise.
      Throws:
      IllegalArgumentException - if the input string is null.