Fix/auth retry stale cookies

client/src/main/java/org/asynchttpclient/netty/handler/intercept/CallerCookies.java

@@ -0,0 +1,102 @@
+/*
+ *    Copyright (c) 2026 AsyncHttpClient Project. All rights reserved.
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+package org.asynchttpclient.netty.handler.intercept;
+
+import io.netty.handler.codec.http.HttpResponse;
+import io.netty.handler.codec.http.cookie.ClientCookieDecoder;
+import io.netty.handler.codec.http.cookie.Cookie;
+import org.asynchttpclient.Request;
+import org.asynchttpclient.RequestBuilder;
+import org.asynchttpclient.cookie.CookieStore;
+import org.asynchttpclient.uri.Uri;
+
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+import static io.netty.handler.codec.http.HttpHeaderNames.SET_COOKIE;
+
+/**
+ * Tells the cookies a caller put on a request from the ones the cookie store added, for the request a redirect
+ * or an authentication retry builds from it. The store's may be older than what the response just set.
+ */
+final class CallerCookies {
+
+    private CallerCookies() {
+    }
+
+    /**
+     * The request's cookies minus the ones the store put there: those this response set, rotated or deleted,
+     * and those the store still holds with the same value. A caller's cookie sharing only a name with a stored
+     * one stays the caller's.
+     */
+    static List<Cookie> of(Request request, HttpResponse response, CookieStore cookieStore, Uri next,
+                           ClientCookieDecoder cookieDecoder) {
+        List<Cookie> cookies = request.getCookies();
+        if (cookies.isEmpty()) {
+            return cookies;
+        }
+        // Only what the store took counts: a Set-Cookie it refused, or one for another path, leaves the
+        // caller's cookie of that name in place.
+        Set<String> setByResponse = new HashSet<>();
+        List<Cookie> nextCookies = null;
+        for (String header : response.headers().getAll(SET_COOKIE)) {
+            Cookie cookie = cookieDecoder.decode(header);
+            if (cookie == null) {
+                continue;
+            }
+            if (cookie.maxAge() != Cookie.UNDEFINED_MAX_AGE && cookie.maxAge() <= 0) {
+                setByResponse.add(cookie.name());
+                continue;
+            }
+            if (nextCookies == null) {
+                nextCookies = cookieStore.get(next);
+            }
+            if (holdsSameValue(nextCookies, cookie)) {
+                setByResponse.add(cookie.name());
+            }
+        }
+        List<Cookie> stored = cookieStore.get(request.getUri());
+        List<Cookie> callers = new ArrayList<>(cookies.size());
+        for (Cookie cookie : cookies) {
+            if (!setByResponse.contains(cookie.name()) && !holdsSameValue(stored, cookie)) {
+                callers.add(cookie);
+            }
+        }
+        return callers;
+    }
+
+    /**
+     * For a retry of the same request: the caller's cookies, then the store's current ones.
+     */
+    static void refresh(RequestBuilder retry, Request request, HttpResponse response, CookieStore cookieStore,
+                        ClientCookieDecoder cookieDecoder) {
+        retry.setCookies(of(request, response, cookieStore, request.getUri(), cookieDecoder));
+        for (Cookie cookie : cookieStore.get(request.getUri())) {
+            retry.addCookieIfUnset(cookie);
+        }
+    }
+
+    private static boolean holdsSameValue(List<Cookie> stored, Cookie cookie) {
+        for (Cookie candidate : stored) {
+            if (candidate.name().equals(cookie.name()) && candidate.value().equals(cookie.value())) {
+                return true;
+            }
+        }
+        return false;
+    }
+}

client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java

@@ -76,8 +76,8 @@ public Interceptors(AsyncHttpClientConfig config,
         this.config = config;
         this.requestSender = requestSender;
         nonceCounter = new NonceCounter();
-        unauthorized401Interceptor = new Unauthorized401Interceptor(channelManager, requestSender, nonceCounter);
-        proxyUnauthorized407Interceptor = new ProxyUnauthorized407Interceptor(channelManager, requestSender, nonceCounter);
+        unauthorized401Interceptor = new Unauthorized401Interceptor(config, channelManager, requestSender, nonceCounter);
+        proxyUnauthorized407Interceptor = new ProxyUnauthorized407Interceptor(config, channelManager, requestSender, nonceCounter);
         continue100Interceptor = new Continue100Interceptor(requestSender);
         redirect30xInterceptor = new Redirect30xInterceptor(channelManager, config, requestSender);
         connectSuccessInterceptor = new ConnectSuccessInterceptor(channelManager, requestSender);

client/src/main/java/org/asynchttpclient/netty/handler/intercept/ProxyUnauthorized407Interceptor.java

@@ -47,6 +47,9 @@
 import java.nio.charset.StandardCharsets;
 import java.util.Base64;
 import java.util.List;
+import org.asynchttpclient.AsyncHttpClientConfig;
+import io.netty.handler.codec.http.cookie.ClientCookieDecoder;
+import org.asynchttpclient.cookie.CookieStore;
 
 import static io.netty.handler.codec.http.HttpHeaderNames.PROXY_AUTHENTICATE;
 import static io.netty.handler.codec.http.HttpHeaderNames.PROXY_AUTHORIZATION;
@@ -60,11 +63,16 @@ public class ProxyUnauthorized407Interceptor {
 
     private static final Logger LOGGER = LoggerFactory.getLogger(ProxyUnauthorized407Interceptor.class);
 
+    private final AsyncHttpClientConfig config;
+    private final ClientCookieDecoder cookieDecoder;
     private final ChannelManager channelManager;
     private final NettyRequestSender requestSender;
     private final NonceCounter nonceCounter;
 
-    ProxyUnauthorized407Interceptor(ChannelManager channelManager, NettyRequestSender requestSender, NonceCounter nonceCounter) {
+    ProxyUnauthorized407Interceptor(AsyncHttpClientConfig config, ChannelManager channelManager, NettyRequestSender requestSender,
+                                    NonceCounter nonceCounter) {
+        this.config = config;
+        cookieDecoder = config.isUseLaxCookieEncoder() ? ClientCookieDecoder.LAX : ClientCookieDecoder.STRICT;
         this.channelManager = channelManager;
         this.requestSender = requestSender;
         this.nonceCounter = nonceCounter;
@@ -165,6 +173,7 @@ public boolean exitAfterHandling407(Channel channel, NettyResponseFuture<?> futu
             HttpHeaders requestHeaders = new DefaultHttpHeaders().add(request.getHeaders());
 
             RequestBuilder nextRequestBuilder = future.getCurrentRequest().toBuilder().setHeaders(requestHeaders);
+            refreshCookies(nextRequestBuilder, request, response);
             if (future.getCurrentRequest().getUri().isSecured()) {
                 nextRequestBuilder.setMethod(CONNECT);
             }
@@ -317,6 +326,7 @@ public boolean exitAfterHandling407(Channel channel, NettyResponseFuture<?> futu
         }
 
         RequestBuilder nextRequestBuilder = future.getCurrentRequest().toBuilder().setHeaders(requestHeaders);
+        refreshCookies(nextRequestBuilder, request, response);
         if (future.getCurrentRequest().getUri().isSecured()) {
             nextRequestBuilder.setMethod(CONNECT);
         }
@@ -371,4 +381,11 @@ private static void ntlmProxyChallenge(String authenticateHeader, HttpHeaders re
             requestHeaders.set(PROXY_AUTHORIZATION, "NTLM " + challengeHeader);
         }
     }
+    // The challenge may have set cookies, and the retry has to carry those, not the values it went out with.
+    private void refreshCookies(RequestBuilder retry, Request request, HttpResponse response) {
+        CookieStore cookieStore = config.getCookieStore();
+        if (cookieStore != null) {
+            CallerCookies.refresh(retry, request, response, cookieStore, cookieDecoder);
+        }
+    }
 }

client/src/main/java/org/asynchttpclient/netty/handler/intercept/Redirect30xInterceptor.java

@@ -48,9 +48,7 @@
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
-import java.util.ArrayList;
 import java.util.HashSet;
-import java.util.List;
 import java.util.Set;
 
 import static io.netty.handler.codec.http.HttpHeaderNames.AUTHORIZATION;
@@ -60,7 +58,6 @@
 import static io.netty.handler.codec.http.HttpHeaderNames.HOST;
 import static io.netty.handler.codec.http.HttpHeaderNames.LOCATION;
 import static io.netty.handler.codec.http.HttpHeaderNames.PROXY_AUTHORIZATION;
-import static io.netty.handler.codec.http.HttpHeaderNames.SET_COOKIE;
 import static org.asynchttpclient.uri.Uri.HTTP;
 import static org.asynchttpclient.uri.Uri.HTTPS;
 import static org.asynchttpclient.uri.Uri.WS;
@@ -212,7 +209,7 @@ public boolean exitAfterHandlingRedirect(Channel channel, NettyResponseFuture<?>
                     requestBuilder.resetCookies();
                 } else {
                     requestBuilder.setCookies(cookieStore == null
-                            ? request.getCookies() : callersOwnCookies(request, response, cookieStore));
+                            ? request.getCookies() : CallerCookies.of(request, response, cookieStore, newUri, cookieDecoder));
                 }
 
                 requestBuilder.setMethod(switchToGet ? GET : originalMethod)
@@ -460,42 +457,6 @@ private enum BodyRepresentation {
         NONE
     }
 
-    /**
-     * The request's cookies minus the ones the store put there: those this response set, rotated or deleted,
-     * and those the store still holds with the same value. A caller's cookie sharing only a name with a stored
-     * one stays the caller's.
-     */
-    private List<Cookie> callersOwnCookies(Request request, HttpResponse response, CookieStore cookieStore) {
-        List<Cookie> cookies = request.getCookies();
-        if (cookies.isEmpty()) {
-            return cookies;
-        }
-        Set<String> setByResponse = new HashSet<>();
-        for (String header : response.headers().getAll(SET_COOKIE)) {
-            Cookie cookie = cookieDecoder.decode(header);
-            if (cookie != null) {
-                setByResponse.add(cookie.name());
-            }
-        }
-        List<Cookie> stored = cookieStore.get(request.getUri());
-        List<Cookie> callers = new ArrayList<>(cookies.size());
-        for (Cookie cookie : cookies) {
-            if (!setByResponse.contains(cookie.name()) && !holdsSameValue(stored, cookie)) {
-                callers.add(cookie);
-            }
-        }
-        return callers;
-    }
-
-    private static boolean holdsSameValue(List<Cookie> stored, Cookie cookie) {
-        for (Cookie candidate : stored) {
-            if (candidate.name().equals(cookie.name()) && candidate.value().equals(cookie.value())) {
-                return true;
-            }
-        }
-        return false;
-    }
-
     private static HttpHeaders propagatedHeaders(Request request, Realm realm, boolean keepBody, boolean stripAuthorization) {
         HttpHeaders headers = request.getHeaders().copy().remove(HOST);
 

client/src/main/java/org/asynchttpclient/netty/handler/intercept/Unauthorized401Interceptor.java

@@ -46,6 +46,10 @@
 import java.nio.charset.StandardCharsets;
 import java.util.Base64;
 import java.util.List;
+import org.asynchttpclient.AsyncHttpClientConfig;
+import io.netty.handler.codec.http.cookie.ClientCookieDecoder;
+import org.asynchttpclient.cookie.CookieStore;
+import org.asynchttpclient.RequestBuilder;
 
 import static io.netty.handler.codec.http.HttpHeaderNames.AUTHORIZATION;
 import static io.netty.handler.codec.http.HttpHeaderNames.WWW_AUTHENTICATE;
@@ -59,11 +63,16 @@ public class Unauthorized401Interceptor {
 
     private static final Logger LOGGER = LoggerFactory.getLogger(Unauthorized401Interceptor.class);
 
+    private final AsyncHttpClientConfig config;
+    private final ClientCookieDecoder cookieDecoder;
     private final ChannelManager channelManager;
     private final NettyRequestSender requestSender;
     private final NonceCounter nonceCounter;
 
-    Unauthorized401Interceptor(ChannelManager channelManager, NettyRequestSender requestSender, NonceCounter nonceCounter) {
+    Unauthorized401Interceptor(AsyncHttpClientConfig config, ChannelManager channelManager, NettyRequestSender requestSender,
+                               NonceCounter nonceCounter) {
+        this.config = config;
+        cookieDecoder = config.isUseLaxCookieEncoder() ? ClientCookieDecoder.LAX : ClientCookieDecoder.STRICT;
         this.channelManager = channelManager;
         this.requestSender = requestSender;
         this.nonceCounter = nonceCounter;
@@ -134,7 +143,9 @@ public boolean exitAfterHandling401(Channel channel, NettyResponseFuture<?> futu
             future.setChannelState(ChannelState.NEW);
             HttpHeaders requestHeaders = new DefaultHttpHeaders().add(request.getHeaders());
 
-            final Request nextRequest = future.getCurrentRequest().toBuilder().setHeaders(requestHeaders).build();
+            RequestBuilder retry = future.getCurrentRequest().toBuilder().setHeaders(requestHeaders);
+            refreshCookies(retry, request, response);
+            final Request nextRequest = retry.build();
             if (LOGGER.isDebugEnabled()) {
                 LOGGER.debug("Sending authentication to {}", request.getUri().toUrlWithoutUserInfo());
             }
@@ -280,7 +291,9 @@ public boolean exitAfterHandling401(Channel channel, NettyResponseFuture<?> futu
                 throw new IllegalStateException("Invalid Authentication scheme " + realm.getScheme());
         }
 
-        final Request nextRequest = future.getCurrentRequest().toBuilder().setHeaders(requestHeaders).build();
+        RequestBuilder retry = future.getCurrentRequest().toBuilder().setHeaders(requestHeaders);
+        refreshCookies(retry, request, response);
+        final Request nextRequest = retry.build();
 
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debug("Sending authentication to {}", request.getUri().toUrlWithoutUserInfo());
@@ -335,4 +348,11 @@ private static void kerberosChallenge(Realm realm, Request request, HttpHeaders
                 realm.getLoginContextName()).generateToken(host);
         headers.set(AUTHORIZATION, NEGOTIATE + ' ' + challengeHeader);
     }
+    // The challenge may have set cookies, and the retry has to carry those, not the values it went out with.
+    private void refreshCookies(RequestBuilder retry, Request request, HttpResponse response) {
+        CookieStore cookieStore = config.getCookieStore();
+        if (cookieStore != null) {
+            CallerCookies.refresh(retry, request, response, cookieStore, cookieDecoder);
+        }
+    }
 }

client/src/test/java/org/asynchttpclient/netty/handler/intercept/AuthRetryCookieTest.java

@@ -0,0 +1,94 @@
+/*
+ *    Copyright (c) 2026 AsyncHttpClient Project. All rights reserved.
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+package org.asynchttpclient.netty.handler.intercept;
+
+import io.netty.handler.codec.http.cookie.DefaultCookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.asynchttpclient.AbstractBasicTest;
+import org.asynchttpclient.AsyncHttpClient;
+import org.asynchttpclient.BoundRequestBuilder;
+import org.eclipse.jetty.server.Request;
+import org.eclipse.jetty.server.handler.AbstractHandler;
+import org.junit.jupiter.api.Test;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+
+import static org.asynchttpclient.Dsl.asyncHttpClient;
+import static org.asynchttpclient.Dsl.basicAuthRealm;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * The retry after a 401 must carry the cookies the challenge set, not the ones the first attempt went out with.
+ */
+public class AuthRetryCookieTest extends AbstractBasicTest {
+
+    private static final String RECEIVED_COOKIE = "received-cookie";
+
+    @Override
+    public AbstractHandler configureHandler() {
+        return new AbstractHandler() {
+            @Override
+            public void handle(String target, Request baseRequest, HttpServletRequest request,
+                               HttpServletResponse response) throws IOException {
+                if ("/seed".equals(target)) {
+                    response.addHeader("Set-Cookie", "SID=old; Path=/");
+                } else if (request.getHeader("Authorization") == null) {
+                    response.addHeader("Set-Cookie", "SID=new; Path=/");
+                    response.setHeader("WWW-Authenticate", "Basic realm=\"test\"");
+                    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+                } else {
+                    String cookie = request.getHeader("Cookie");
+                    if (cookie != null) {
+                        response.setHeader(RECEIVED_COOKIE, cookie);
+                    }
+                }
+                baseRequest.setHandled(true);
+            }
+        };
+    }
+
+    @Test
+    void theRetrySendsTheSessionTheChallengeSet() throws Exception {
+        assertEquals(new HashSet<>(Arrays.asList("SID=new")), cookiesOnRetry(null));
+    }
+
+    @Test
+    void theCallersCookieSurvivesTheRetry() throws Exception {
+        assertEquals(new HashSet<>(Arrays.asList("X=1", "SID=new")), cookiesOnRetry(new DefaultCookie("X", "1")));
+    }
+
+    private Set<String> cookiesOnRetry(DefaultCookie callerCookie) throws Exception {
+        try (AsyncHttpClient client = asyncHttpClient()) {
+            client.prepareGet(url("/seed")).execute().get(TIMEOUT, TimeUnit.SECONDS);
+            BoundRequestBuilder request = client.prepareGet(url("/protected"))
+                    .setRealm(basicAuthRealm("user", "pass").setUsePreemptiveAuth(false));
+            if (callerCookie != null) {
+                request.addCookie(callerCookie);
+            }
+            String header = request.execute().get(TIMEOUT, TimeUnit.SECONDS).getHeader(RECEIVED_COOKIE);
+            return header == null ? new HashSet<>() : new HashSet<>(Arrays.asList(header.split("; ")));
+        }
+    }
+
+    private String url(String path) {
+        return "http://localhost:" + port1 + path;
+    }
+}