Match Apache Maven's anonymous-first authentication for POM and JAR downloads#8169
Open
Jammy-Louie wants to merge 6 commits into
Open
Match Apache Maven's anonymous-first authentication for POM and JAR downloads#8169Jammy-Louie wants to merge 6 commits into
Jammy-Louie wants to merge 6 commits into
Conversation
Mirror Apache Maven Resolver's DeferredCredentialsProvider: issue POM, metadata, reachability, jar-existence, and artifact requests without credentials, and send Basic auth only once the server challenges an anonymous request with a 4xx. Both downloaders previously applied credentials preemptively, leaking them to repositories that serve anonymously. Split out applyTimeoutToRequest so anonymous requests keep their timeouts without sending configured headers or credentials.
…robes Add a session-scoped MavenAuthenticationCache on the ExecutionContext that records repository endpoints (host:port) which challenged an anonymous request. Once a host is known to require credentials, both MavenPomDownloader and MavenArtifactDownloader authenticate preemptively rather than paying another anonymous 401 round-trip, mirroring Apache Maven Resolver's per-session BasicAuthCache. MavenArtifactDownloader now accepts an ExecutionContext (additive constructors; existing ones default to a per-instance context) so the JAR phase shares the cache populated during POM resolution. JavaRewriteRpc passes its context through.
timtebeek
reviewed
Jul 9, 2026
timtebeek
reviewed
Jul 9, 2026
Match the codebase convention where ExecutionContext is the trailing argument on most multi-arg method signatures.
timtebeek
reviewed
Jul 9, 2026
timtebeek
left a comment
timtebeek
left a comment
Member
There was a problem hiding this comment.
Couple guiding questions; nothing that can't be fixed I think. Let me know your thoughts and happy to work this in if you agree.
Address PR review feedback: fold the anonymous-first authentication cache into MavenExecutionContextView alongside getUnreachableEndpoints(), so the two endpoint-tracking behaviors live side by side instead of in a separate MavenAuthenticationCache class. Also consult the cache in jarExistsForPomUri so the JAR-existence HEAD probe authenticates preemptively for hosts already known to require credentials.
timtebeek
force-pushed
the
maven-anonymous-first-auth
branch
from
139268d to
7218621
Compare
The constructors that don't accept an ExecutionContext fall back to a throwaway InMemoryExecutionContext, so the anonymous-first authentication cache cannot be shared with POM/metadata resolution. Deprecate them in favor of the ExecutionContext-accepting overloads and migrate the in-tree test callers accordingly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
MavenPomDownloader(reachability probes, jar-existence HEAD, and body/metadata GETs) andMavenArtifactDownloadernow request without credentials first and retry with credentials on a credential-rejecting 4xx. This also stops sending credentials to repositories that serve anonymously.host:portset on theExecutionContextrecords which endpoints required authentication, mirroring Maven Resolver'sBasicAuthCache(and the existinggetUnreachableEndpointspattern). Once a host is known to require auth, both downloaders authenticate preemptively.MavenArtifactDownloadergains additiveExecutionContextconstructors, andJavaRewriteRpcpasses its context through so the jar phase shares the cache warmed during POM resolution.The first request to a private host costs one extra anonymous 401 probe before authenticating; the cache limits this to once per host per session, the same one-time cost Maven pays.
Test plan
MavenPomDownloaderTest#doesNotSendCredentialsWhenRepositoryServesAnonymouslyMavenPomDownloaderTest#authenticatesPreemptivelyAfterCredentialsRequiredMavenArtifactDownloaderTest#retriesWithCredentialsWhenAnonymousReturns401,#retriesWithHttpHeaderAuthWhenAnonymousReturns401MavenArtifactDownloaderTest#doesNotFallBackToAnonymousOnTransientClientErrorMavenArtifactDownloaderTest#authenticatesPreemptivelyAfterFirstChallengeForSameHostrewrite-mavenmodule test suite