quarkus-rest-client-reactive-jackson removing credentials from URIs and URLs

[Cs4r]

Describe the bug

The quarkus-rest-client-reactive-jackson is not properly handling URIs that contain a username and password. When making a request to such a URI, the username and password are being removed from the URI, resulting in the request failing due to authentication issues.

PD: It's also happening when using URLs:

RestClientBuilder.newBuilder().baseUrl(urlToInvoke)...build();

Expected behavior

The POST request should be made to the URI "https://USER:[email protected]:23090/topics/topic-name" and include the username and password in the URI.

Actual behavior

The request is made to the URI "https://public-develop-company-dev.cloud.com:23090/topics/topic-name" hence the username and password are removed from the URI

How to Reproduce?

1. Create a new Quarkus application and add the quarkus-rest-client-reactive-jackson dependency to the project.
2. In the code, use the RestClientBuilder (RestClientBuilder.newBuilder().baseUri(uriToInvoke)...build();) to create a new client and set the base URI to a URI that includes a username and password, such as "https://USER:[email protected]:23090/topics/topic-name".
3. Make a request to the URI using the created client.
4. Actual URI invoked: "https://public-develop-company-dev.cloud.com:23090/topics/topic-name"

Quarkus version or git rev

2.12.0.CR1 and 2.15.2.Final

Additional information

As seen in the provided log below, got using the following application properties:

quarkus.rest-client.logging.scope=request-response
quarkus.rest-client.logging.body-limit=1024
quarkus.log.category."org.jboss.resteasy.reactive.client.logging".level=DEBUG

the quarkus-rest-client-reactive-jackson library is sending the request with an incorrect URI:

Request:

POST https://public-develop-company-dev.cloud.com:23090/topics/topic-name Headers[Accept=application/json Content-Type=application/vnd.kafka.json.v2+json User-Agent=Resteasy Reactive Client content-length=407], Body: {"records":[{"value":{ "body": "theBody" }}]}

As you can see, it is not including the credentials "USER:PASSWORD" in the URI. Instead, the credentials are being removed, resulting in the request failing due to authentication issues.

Also, it can be noticed that the request contains headers such as Accept=application/json, Content-Type=application/vnd.kafka.json.v2+json, User-Agent=Resteasy Reactive Client and content-length=407 which can also provide some information about the request.

It is important to note that this bug can cause issues when trying to connect to a service that requires authentication and can prevent the application from communicating with this service.

[quarkus-bot]

/cc @Sgitario(rest-client), @cescoffier(rest-client), @geoand(jackson,rest-client), @gsmet(jackson)

[geoand]

Does the same happen with Quarkus 2.15.2.Final?

[Cs4r]

Hey @geoand,

I have just tried and it also happens with 2.15.3.Final

[geoand]

Thanks for checking. We will have a look soon

[geoand]

Would you mind uploading a sample so we can use it for testing?

[Cs4r]

@geoand here's the minimum code to reproduce the bug => https://github.com/Cs4r/quarkus-rest-client-bug

If you run the test named QuarkusContextIT you will be able to see the Request and Response in the logs:

Request:

2023-01-12 14:08:09,113 DEBUG [org.jbo.res.rea.cli.log.DefaultClientLogger] (vert.x-eventloop-thread-3) Request: POST https://public-develop-lottoland-dev.aivencloud.com:23090/topics/topic Headers[Accept=application/json Content-Type=application/vnd.kafka.json.v2+json User-Agent=Resteasy Reactive Client content-length=41], Body:
{"records":[{"value":{"status": "ok" }}]}

Please observe that POSTed URL lacks username and password, as it should be https://USER:[email protected]:23090/topics/topic).

Response

2023-01-12 14:08:09,206 DEBUG [org.jbo.res.rea.cli.log.DefaultClientLogger] (vert.x-eventloop-thread-3) Response: POST https://public-develop-lottoland-dev.aivencloud.com:23090/topics/topic, Status[401 Unauthorized], Headers[Content-Length=110 WWW-Authenticate=Basic realm="service_rest_users" Cache-Control=no-cache Content-Type=text/html Strict-Transport-Security=max-age=31536000; includeSubDomains Referrer-Policy=no-referrer], Body:
<html><body><h1>401 Unauthorized</h1>You need a valid user and password to access this content.</body></html>

[geoand]

Thank you

[gsmet]

Probably a good idea to check we don't convert that to basic authentication headers. i know some layers are doing that automatically.

[Cs4r]

@gsmet according to the logs it seems it doesn't transform the USER:PASSWORD into authentication headers

[geoand]

I'll try and have a look tomorrow

[geoand]

#30344 takes care of the issue