Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Infinite loop detected after redirection and authorization challenge #732

Open
uap-universe opened this issue Jun 16, 2021 · 0 comments
Open

Comments

@uap-universe
Copy link

Observed in tyrus client 1.17.

Consider the following scenario:
Connect to a websocket endpoint ws://myserver.example/myendpoint
The server uses HTTP Basic Auth and redirects you to use wss for obvious security reasons.
(Assume redirect is enabled in tyrus client).

The flow should be as follows:

Request ws://
Response 301
Request wss:// (without credentials)
Response 401
Request wss:// (with credentials)

The actual flow is:

Request ws://
Response 301
Request wss:// (without credentials)
Response 401
Request ws:// (with credentials)
Response 301
--- infinite loop detected ---

The reason is that tyrus uses the old (original) URL to comply with the authorization challenge, which of course results in another redirect. Since the client already followed the redirect in the current connection attempt, the infinite loop detection kicks in (see here).

I see two possible fixes:

  1. Use the new URL to respond to the 401 challenge
  2. Follow the redirect a second time (in other words: relax the infinite loop detection, maybe by using the threshold parameter)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant