Search code examples
androidapache-httpclient-4.xandroidhttpclient

Moving to Apache HttpClient 4.3, how to get legacy interceptor behavior with digest authentication?

Our Android app has been using the Android-bundled HttpClient for several years. We have grown a fair amount of code that manipulates the interaction with our server product. Each time we call execute(post), HttpClient's interaction with the server goes like this:

  1. Client sends HTTP POST to server.
  2. Server responds with 401 Not Authorized and provides a digest authentication challenge.
  3. Client resends HTTP POST to server, including digest authentication response (we supply a CredentialsProvider before step 1, so the authentication response is generated automatically by HttpClient).
  4. Server accepts authorization and responds with 200. The call to execute() returns the 200 response and the body accompanying the 200 response.

We've been running into a problem with the HTTP library that ships with Android on several devices. We tried to move to Apache 4.3 in the Android app, but the interceptor behavior is different. Traditionally, the request interceptor would fire twice: on step 1 and step 3. The response interceptor would fire twice, too: on step 2 and step 4. We only needed them for step 2 and step 3, but it was easy to have the interceptors exit early on steps 1 and 4. Since moving to HttpClient 4.3, the request interceptor is only firing on step 1, when we don't need it.

Is there a configuration option that would restore the old behavior? We've also tried linking in our own copy of HttpClient 4.2, but that's not going well either.

Thank you!

Solution

  • Request execution pipeline was completely redesigned 4.3 largely to provide better support for transparent response caching and content decompression. As of 4.3 requests that require authentication no longer get reset, re-evaluated and re-wired from scratch. There is no way to restore the old behavior with the new execution pipeline. One however can use (or rather abuse) a custom AuthenticationStrategy in order to intercept request execution before during an authentication handshake.