2

I just realized that my base64 encoded Header "Authentication" can't be read with request.getHeader("Authentication").

I found this post about that it's a security Feature in URLConnection

getRequestProperty("Authorization") always returns null , i don't know why but it seems to be true for request.getHeader as well.

How can i still get this Header if l don't want to Switch to other libraries?

Community
  • 1
  • 1
MADforFUNandHappy
  • 538
  • 6
  • 24

2 Answers2

0

I was searching through https://fossies.org/dox/apache-tomcat-6.0.45-src/catalina_2connector_2Request_8java_source.html#l01947 and found a section where restricted headers will be used if Globals.IS_SECURITY_ENABLED is set.

Since I'm working on a reverse Proxy and only Need to pass requests/Responses through I did simply set "System.setSecurityManager(null);" and for my case it might be a valid solution but if you want to use authentication there is no reason to use this Workaround.

My bad, it does work with https now.

MADforFUNandHappy
  • 538
  • 6
  • 24
  • Won't work in unit tests unfortunately – tried setting `System.setSecurityManager(null);` and `connection.getRequestProperty("Authorization")` still returns null although explicitely set before. Any other ideas? – Philzen Oct 13 '21 at 16:42
0

The accepted solution did not work for me – may have something to do with different runtime environments.

However, i've managed to come up with a working snippet to access the underlying MessageHeader-collection via reflection and extract the "Authorization"-header value.

Philzen
  • 3,945
  • 30
  • 46