Skip to content

CXF-9226: AsyncHTTPConduit throws ISE instead of HTTPException(407) o…#3255

Open
ffang wants to merge 1 commit into
apache:mainfrom
ffang:CXF-9226
Open

CXF-9226: AsyncHTTPConduit throws ISE instead of HTTPException(407) o…#3255
ffang wants to merge 1 commit into
apache:mainfrom
ffang:CXF-9226

Conversation

@ffang

@ffang ffang commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

…n proxy auth failure

When the HC5 async conduit receives a 407 Proxy Authentication Required response with wrong credentials and MaxRetransmits>0 or AutoRedirect=true (as in the JIRA), the request entity is marked repeatable so HC5 retries after the first 407. A concurrent write-failure on the Connection: close socket races with the retry's execute() call, causing InternalHttpAsyncExecRuntime.ensureValid() to find a null endpointRef and throw IllegalStateException. Without MaxRetransmits/AutoRedirect the entity is not repeatable and HC5 intercepts the 407 internally, calling asyncExecCallback.completed() without signaling CXF's future and leaving getHttpResponse() blocked indefinitely on wait().

Fix:

  • Promote HttpClientContext ctx to a field on AsyncWrappedOutputStream so it is accessible after HC5 calls back.
  • Replace wait() with wait(receiveTimeout) to bound the wait.
  • In both the timeout path and the RuntimeException (ISE) path, check ctx.getResponse() for a 407 status and throw HTTPException(407) instead of re-throwing the raw exception or blocking forever.

Test:

  • ProxyAuthIllegalStateTest: reproduces the ISE via a raw ServerSocket proxy returning 407+Connection:close, with MaxRetransmits=5 and AutoRedirect=true matching the exact JIRA configuration.

…n proxy auth failure

When the HC5 async conduit receives a 407 Proxy Authentication Required
response with wrong credentials and MaxRetransmits>0 or AutoRedirect=true
(as in the JIRA), the request entity is marked repeatable so HC5 retries
after the first 407. A concurrent write-failure on the Connection: close
socket races with the retry's execute() call, causing
InternalHttpAsyncExecRuntime.ensureValid() to find a null endpointRef and
throw IllegalStateException. Without MaxRetransmits/AutoRedirect the entity
is not repeatable and HC5 intercepts the 407 internally, calling
asyncExecCallback.completed() without signaling CXF's future and leaving
getHttpResponse() blocked indefinitely on wait().

Fix:
- Promote HttpClientContext ctx to a field on AsyncWrappedOutputStream so
  it is accessible after HC5 calls back.
- Replace wait() with wait(receiveTimeout) to bound the wait.
- In both the timeout path and the RuntimeException (ISE) path, check
  ctx.getResponse() for a 407 status and throw HTTPException(407) instead
  of re-throwing the raw exception or blocking forever.

Test:
- ProxyAuthIllegalStateTest: reproduces the ISE via a raw ServerSocket
  proxy returning 407+Connection:close, with MaxRetransmits=5 and
  AutoRedirect=true matching the exact JIRA configuration.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant