Re: The simplest way to download a file from http resource that need authentication

Lew wrote:


Nooo, really?

There is a race conditions. Here the example:

We have two thread: t1 and t2 that executes the following code

   void download(URL url, String username, String password)
   throws IOException
   {

     Authenticator.setDefault(new Authenticator() {
       protected PasswordAuthentication getPasswordAuthentication() {
          return new PasswordAuthentication(username,
password.toCharArray());
       }});
     URLConnection con = url.openConnection();
     BufferedInputStream in;
     in = new BufferedInputStream(con.getInputStream());
     OutputStream out = new FileOutputStream("C:\\file.txt");

     int i = 0;
     byte[] bytesIn = new byte[8096];
     while ((i = in.read(bytesIn)) >= 0) {
        out.write(bytesIn, 0, i);
     }
     out.close();
     in.close();
   }

Each thread should download different url using different username and
password.
t1 use "http://example.org/foo" as url and "foo","foo" as username,
password.

t1 use "http://example2.org/bar" as url and "bar","bar" as username,
password.

Ipotize this course of events:
   t1 starts
   t1 call Authenticator.setDefault() using "foo","foo" as
username,password.
   t1 is suspensed by the scheduler
   t2 starts
   t2 call Authenticator.setDefault() using "bar","bar" as
username,password.
   t2 call openConnection(); that will use the correct username and
password ("bar","bar")
   t2 download the file.
   t2 terminates.
   t1 is resumed by the scheduler
   t1 call openConnection(); but the username and password were changed,
from the correct values ("foo", "foo") to the values used by t2
("bar,"bar"). The openConnection fails.

The correcteness of the programs depend of the scheduling, hence there
is a race condition. The race conditions depends from the fact that
Authenticator.setDefault() is static and hence the same data is shared
by all threads.