Digest Auth support in WebClient

Spring’s WebClient allows specifying Basic Auth credentials quite simply:

webClient.get()
        .uri(someEndpoint)
        .headers(httpHeaders -> httpHeaders.setBasicAuth(someUserName, somePassword))
        ...

However, there doesn’t seem to be a way to configure the WebClient to perform Digest Auth (RFC 7616).

A lot of servers rely on Digest Auth, and given that WebClient supports the less secure Basic Auth protocol, it would make sense to add support to the client’s capabilities. Note that this feature has been requested in other places, for example on StackOverflow.

Thanks for considering this feature request!

Issue originally posted in the Spring Security project (https://github.com/spring-projects/spring-security/issues/7861).

[rstoyanchev]

This is a reasonable request although digest is more involved than basic authentication, and also some HTTP libraries like the Jetty client have built-in support, so we’d likely leave this to be done at that level, and at the Spring Framework level make sure it can be plugged in.

In regards to Netty, I see no built-in support. However there is one external library that might be a good place to start if you need to do this. I did not try it but from a quick look, I think it could be plugged into Reactor Netty and the WebClient like this:

HttpClient client = HttpClient.create().doOnRequest((request, connection) -> {
	connection.addHandler(new HttpObjectAggregator(1048576));
	connection.addHandler(new NettyHttpAuthenticator("...", "..."));
});

ReactorClientHttpConnector connector = new ReactorClientHttpConnector(client);
WebClient client = WebClient.builder().clientConnector(connector).build();

NettyHttpAuthenticator expects (aggregated) FullHttpRequest and FullHttpResponse. Hence the HttpObjectAggregator above, and if the client sends synchronous values or Mono (but not Flux) the above could work. Further on, fully aggregated request and response should not be needed I believe, since the interaction involves just status and headers, so NettyHttpAuthenticator could probably be modified to use HttpRequest and HttpResponse and then it would work more generally.

Those are suggestions to try if you’re stuck for something.

[sebphil]

Hi! I’m having the same issue and would love to see a full digest auth client implementation in Spring WebClient.

In the meantime, I followed the ideas previously mentioned and came up with a solution that involves a FilterFunction. This enables the handling of Digest Auth as a crosscutting concern and lets you keep your actual webservice call code clean.

This filter makes use of @vzhn 's netty-http-authenticator to handle the parsing and construction of the various headers involved in Digest Auth.

Here is the gist: Digest Auth in Spring WebClient