From a9178a20fcdaa8758d9d8be40be22fa8ad64da3c Mon Sep 17 00:00:00 2001 From: Jonas Finnemann Jensen Date: Mon, 13 Aug 2018 12:28:54 +0000 Subject: [PATCH] Documented issues with HttpClient.authenticate Retries following `HttpClient.authenticate` does not include the original request payload, this is an issue as POST, PUT, PATCH request can be retried through this mechanism. This patch advices of the issue and suggests using `HttpClient.AddCredentials` directly or setting the `'authorization'` header manually. Closes https://github.com/dart-lang/sdk/issues/28012 --- It is possible that we should use even stronger language. It is not immediately obvious to me when the `HttpClient.authenticate` property is useful. But retrying POST, PUT, PATCH requests without sending the body again is problematic. Perhaps we should print a warning when requests with a payload a retries. Or maybe even deprecate the `HttpClient.authenticate` property. I'm new here so please educate me on the useful use-cases. Change-Id: Iaddba39c2fbb08fd31dda77bf19b9856bfa947f3 Reviewed-on: https://dart-review.googlesource.com/69161 Reviewed-by: Martin Kustermann --- sdk/lib/_http/http.dart | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/sdk/lib/_http/http.dart b/sdk/lib/_http/http.dart index 691f15298e9..29e785b699a 100644 --- a/sdk/lib/_http/http.dart +++ b/sdk/lib/_http/http.dart @@ -1761,9 +1761,16 @@ abstract class HttpClient { * [addCredentials] before completing the [Future] with the value * [:true:]. * - * If the [Future] completes with true the request will be retried - * using the updated credentials. Otherwise response processing will + * If the [Future] completes with [:true:] the request will be retried + * using the updated credentials, however, the retried request will not + * carry the original request payload. Otherwise response processing will * continue normally. + * + * If it is known that the remote server requires authentication for all + * requests, it is advisable to use [addCredentials] directly, or manually + * set the `'authorization'` header on the request to avoid the overhead + * of a failed request, or issues due to missing request payload on retried + * request. */ set authenticate(Future f(Uri url, String scheme, String realm));