docs: document Basic-only proxy auth across both transports#133
Merged
Conversation
The proxy-auth documentation contradicted itself. ProxyOptions told callers the JDK transport "negotiates Basic or Digest" with the proxy, the JDK transport's KDoc steered Digest users to the OkHttp transport, and the OkHttp transport's KDoc said it only ever emits Basic. At most one of those could be right. In reality both shipped transports authenticate the proxy with Basic only. The OkHttp proxyAuthenticator always responds with Credentials.basic(...). The JDK transport installs a java.net.Authenticator on java.net.http.HttpClient, whose built-in handling of a registered authenticator covers the Basic scheme only and does not drive Digest proxy auth through that hook. Reconcile all three KDoc blocks and the two runtime warning strings: - ProxyOptions now states both transports do Basic-only proxy auth and points Digest-proxy users at a caller-supplied client (a java.net.http.HttpClient / OkHttpClient with their own authenticator) passed through create(...). - The JDK transport KDoc records the Basic-only limitation explicitly and drops the "use the OkHttp transport for Digest" steer, which sent readers in a circle. The challenge-handler warning now points at the BYO-client path. - The OkHttp transport warning likewise points at a BYO OkHttpClient with a custom proxyAuthenticator instead of implying another shipped transport supports Digest. Add a ProxyAuthenticator test pinning that the JDK authenticator returns the raw credentials regardless of the advertised scheme, so the Basic-only behaviour is the JDK client's and a Digest-only proxy is not satisfied end-to-end. Closes #109
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The proxy-authentication documentation contradicted itself across
ProxyOptionsand the two shipped transports:ProxyOptionstold callers the JDK transport "negotiates Basic or Digest" with the proxy.At most one of those could be right, and a reader following the docs was sent in a circle.
Reality
Both shipped transports authenticate the proxy with Basic only:
proxyAuthenticatoralways responds withCredentials.basic(...)and aProxy-Authorization: Basic …header. There is no Digest code path.java.net.Authenticatoronjava.net.http.HttpClient. The client's built-in handling of a registered authenticator covers the Basic scheme only; it does not drive Digest proxy auth through that hook.Change
Reconcile all three KDoc blocks and the two runtime warning strings:
ProxyOptionsnow states that both transports do Basic-only proxy auth, and points Digest-proxy users at a caller-supplied client (ajava.net.http.HttpClient/OkHttpClientwith their own authenticator) passed throughcreate(...).OkHttpClientwith a customproxyAuthenticatorinstead of implying another shipped transport supports Digest.A
ProxyAuthenticatortest pins that the JDK authenticator returns the raw credentials regardless of the advertised scheme, so the Basic-only behaviour is the JDK client's and a Digest-only proxy is not satisfied end-to-end.No public API signatures change.
Closes #109