Package org.mockserver.authentication

Class ProxyAuthenticationValidator

java.lang.Object

org.mockserver.authentication.ProxyAuthenticationValidator

public final class ProxyAuthenticationValidator
extends Object

The single validation point for HTTP forward-proxy Proxy-Authorization credentials, shared by the CONNECT path and the plain HTTP proxy path.

Why this exists. Both paths previously checked the credential with request.containsHeader(PROXY_AUTHORIZATION, "Basic " + base64), which routes into KeysToMultiValues.containsEntry and compares with String.equalsIgnoreCase(java.lang.String). That is wrong twice over for a credential:

• Base64 is case-SENSITIVE, so a case-insensitive comparison accepts tokens that differ from the configured one in case — roughly one bit of entropy lost per alphabetic character in the credential.
• equalsIgnoreCase short-circuits on the first differing character, reintroducing exactly the timing side channel ConstantTimeEquals exists to close.

Routing both call sites through here means there is one audited comparison, and ProxyAuthenticationValidatorTest can assert that a case-mutated credential is REJECTED — a guard that fails if either call site ever drifts back off the constant-time path.

Method Summary

Modifier and Type	Method	Description
static String	expectedProxyAuthorizationHeaderValue(String username, String password)	The Proxy-Authorization header value the configured credentials require.
static boolean	isAuthenticated(HttpRequest request, String username, String password)	Validate the request's Proxy-Authorization header against the configured credentials.
static boolean	proxyAuthenticationConfigured(String username, String password)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

proxyAuthenticationConfigured

public static boolean proxyAuthenticationConfigured(String username,
 String password)

Returns:

true when proxy authentication is configured (both username and password non-blank) and therefore must be enforced

expectedProxyAuthorizationHeaderValue

public static String expectedProxyAuthorizationHeaderValue(String username,
 String password)

The Proxy-Authorization header value the configured credentials require.

isAuthenticated

public static boolean isAuthenticated(HttpRequest request,
 String username,
 String password)

Validate the request's Proxy-Authorization header against the configured credentials.

The comparison is EXACT (case-sensitive, as base64 requires) and constant-time. Every candidate header value is compared without short-circuiting on the result, so the number of comparisons does not depend on which value matched.

Returns:

true if the request carries a valid credential, or if proxy authentication is not configured (nothing to enforce)