Re: WWW-Authenticate header API : get/setURI

Correction: this should be about the (Proxy-)Authorization headers.

WWWAuthenticateHeader already has a deprecated getURI/setURI

Regards,
Jeroen

Jeroen van Bemmel wrote:
> All,
> 
> Ran into a minor issue today that I thought I might share here, at least 
> to document it
> 
> The WWWAuthenticateHeader and its derived class ProxyAuthenticateHeader 
> have methods 'URI getURI' and 'setURI(URI)' for the "uri" parameter, 
> which typically gets set to the request URI.
> 
> However, today I encountered a client that used a value like "string" 
> for this parameter, not a valid URI. I checked with RFC3261, which 
> defers to RFC2616 (HTTP 1.1) which in turn points to RFC2396 (general 
> URI syntax)
> 
> RFC2616 section 5.1.2 defines Request-URI as:
> Request-URI    = "*" | absoluteURI | abs_path | authority
> 
> RFC2396 defines authority as:
> authority     = server | reg_name
> reg_name      = 1*( unreserved | escaped | "$" | "," |
>                           ";" | ":" | "@" | "&" | "=" | "+" )
> 
> so, strictly speaking, "string" is indeed a valid value for the "uri" 
> parameter.
> 
> getURI() throws a ParseException when the value does not contain a valid 
> scheme part (i.e. "scheme:something").
> 
> In order to fix this, in a future version of the API, getURI/setURI 
> should be defined as using a String for parameter. Perhaps we should 
> create new methods e.g. "getURIString" and "setURIString", and deprecate 
> the existing ones.
> 
> Regards,
> Jeroen