java - 使用 Java Apache HttpClient Fluent API 管理 Cookie

Question

我无法弄清楚如何使用 Apache HttpComponents/HttpClient Fluent API 并让它正确地将 cookie 发送回需要登录的 Web 服务器，然后发送回 cookie 以访问网站的其他部分。我使用的是 4.5.3 版。

根据 Fluent API 教程，您可以使用 (HttpComponents) 执行器“以便在特定的安全上下文中执行请求，从而缓存身份验证详细信息并重新用于后续请求。” https://hc.apache.org/httpcomponents-client-4.5.x/tutorial/html/fluent.html

所以我试过了，但我在登录后尝试访问另一个页面时收到 403 访问被拒绝。这是我试过的代码:

CookieStore httpCookieStore = new BasicCookieStore();
List<Cookie> cookies = httpCookieStore.getCookies();

String username = "admin";
String password = "admin";
Executor httpExecutor = Executor.newInstance().auth(username, password);
httpExecutor.use(httpCookieStore);
Response response = httpExecutor.execute(Request.Get("http://myserver.example.com/login").useExpectContinue());
String loginOutput = response.returnContent().asString();
System.out.println(loginOutput);  // works - gets the expected page

String swaggerUrl = "http://myserver.example.com/swagger/index.html";
response = httpExecutor.execute(Request.Get(swaggerUrl));
HttpResponse httpResponse = response.returnResponse();
System.out.println(httpResponse);  // Response is 403 Access Denied
// prints: HttpResponseProxy{HTTP/1.1 403 Access Denied [X-Content-Type-Options: nosniff, X-XSS-Protection: 1; mode=block, Pragma: no-cache, X-Frame-Options: DENY, Content-Type: text/html;charset=ISO-8859-1, Cache-Control: must-revalidate,no-cache,no-store, Content-Length: 1391, Server: Jetty(8.1.16.v20140903)] [Content-Type: text/html; charset=ISO-8859-1,Content-Length: 1391,Chunked: false]}

登录后我检查了 CookieStore 的内容，它有正确的 cookie:

System.out.println(httpCookieStore.getCookies().size()); // prints 1
System.out.println(httpCookieStore.getCookies().get(0)); 
// prints: [version: 0][name: JSESSIONID][value: 14b1yp7hf85es1vc6zpe2y376n][domain: myserver.example.com][path: /][expiry: null]

所以我也尝试将 cookie 显式添加到 GET 请求的 header 中，但仍然失败并出现相同的 403 访问被拒绝错误:

CookieStore httpCookieStore = new BasicCookieStore();
List<Cookie> cookies = httpCookieStore.getCookies();

String username = "admin";
String password = "admin";
Executor httpExecutor = Executor.newInstance().auth(username, password);
httpExecutor.use(httpCookieStore);
Response response = httpExecutor.execute(Request.Get("http://myserver.example.com/login").useExpectContinue());
String loginOutput = response.returnContent().asString();
System.out.println(loginOutput);  // works - gets the expected page

String swaggerUrl = "http://myserver.example.com/swagger/index.html";
response = httpExecutor.execute(Request.Get(swaggerUrl).addHeader(authCookieName, authCookieValue));
HttpResponse httpResponse = response.returnResponse();
System.out.println(httpResponse);  // Response is 403 Access Denied

关于如何使用 Fluent API 实现这一点有什么想法吗？

Answer 1

在查看您链接的 HttpClient 文档时，他们从这个警告开始(强调我的):

As of version of 4.2 HttpClient comes with an easy to use facade API based on the concept of a fluent interface. Fluent facade API exposes only the most fundamental functions of HttpClient and is intended for simple use cases that do not require the full flexibility of HttpClient. For instance, fluent facade API relieves the users from having to deal with connection management and resource deallocation.

你很可能会遇到通过流畅的 api 进行不支持配置的情况(并且从他们的文档中回答你的报价，身份验证和 session 管理是链接的，但不是强制性的:你可能有一些无状态服务要求对于每个请求的授权信息而无需启动 session ，您显然可以创建 session (由 cookie 支持)而无需询问授权信息)

您可能不得不求助于其他更详细的 API:

BasicCookieStore cookieStore = new BasicCookieStore();
CloseableHttpClient httpclient = HttpClients.custom()
    .setDefaultCookieStore(cookieStore)
    .build();
try {
    HttpGet httpget = new HttpGet("https://someportal/");
    CloseableHttpResponse response1 = httpclient.execute(httpget);
    try {
       ...