undefect. CWE-407 — 63 sites patched across 27 ecosystems

Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com

Patches, unit tests, benchmarks, whitepaper, and outreach briefs.
Public domain — no copyright claimed. Use freely.

test/jdk/java/net/HttpURLConnection/SetAuthenticator/HTTPSetAuthenticatorTest.java

@@ -0,0 +1,288 @@
+/*
+ * Copyright (c) 2016, 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.IOException;
+import java.net.Authenticator;
+import java.net.HttpURLConnection;
+import java.net.Proxy;
+import java.net.URL;
+import java.util.Arrays;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+/*
+ * @test
+ * @bug 8169415
+ * @library /test/lib
+ * @modules java.logging
+ *          java.base/sun.net.www
+ *          java.base/sun.net.www.protocol.http
+ *          jdk.httpserver/sun.net.httpserver
+ * @build jdk.test.lib.net.SimpleSSLContext HTTPTest HTTPTestServer HTTPTestClient HTTPSetAuthenticatorTest
+ * @summary A simple HTTP test that starts an echo server supporting the given
+ *          authentication scheme, then starts a regular HTTP client to invoke it.
+ *          The client first does a GET request on "/", then follows on
+ *          with a POST request that sends "Hello World!" to the server.
+ *          The client expects to receive "Hello World!" in return.
+ *          The test supports several execution modes:
+ *            SERVER: The server performs Server authentication;
+ *            PROXY:  The server pretends to be a proxy and performs
+ *                    Proxy authentication;
+ *            SERVER307: The server redirects the client (307) to another
+ *                    server that perform Server authentication;
+ *            PROXY305: The server attempts to redirect
+ *                    the client to a proxy using 305 code;
+ *           This test runs the client several times, providing different
+ *           authenticators to the HttpURLConnection and verifies that
+ *           the authenticator is invoked as expected - validating that
+ *           connections with different authenticators do not share each
+ *           other's socket channel and authentication info.
+ *           Note: BASICSERVER means that the server will let the underlying
+ *                 com.sun.net.httpserver.HttpServer perform BASIC
+ *                 authentication when in Server mode. There should be
+ *                 no real difference between BASICSERVER and BASIC - it should
+ *                 be transparent on the client side.
+ * @run main/othervm HTTPSetAuthenticatorTest NONE SERVER PROXY SERVER307 PROXY305
+ * @run main/othervm -Dhttp.auth.digest.reEnabledAlgorithms=MD5 HTTPSetAuthenticatorTest DIGEST SERVER
+ * @run main/othervm -Dhttp.auth.digest.reEnabledAlgorithms=MD5 HTTPSetAuthenticatorTest DIGEST PROXY
+ * @run main/othervm -Dhttp.auth.digest.reEnabledAlgorithms=MD5 HTTPSetAuthenticatorTest DIGEST PROXY305
+ * @run main/othervm -Dhttp.auth.digest.reEnabledAlgorithms=MD5 HTTPSetAuthenticatorTest DIGEST SERVER307
+ * @run main/othervm HTTPSetAuthenticatorTest BASIC  SERVER
+ * @run main/othervm HTTPSetAuthenticatorTest BASIC  PROXY
+ * @run main/othervm HTTPSetAuthenticatorTest BASIC  PROXY305
+ * @run main/othervm HTTPSetAuthenticatorTest BASIC  SERVER307
+ * @run main/othervm HTTPSetAuthenticatorTest BASICSERVER SERVER
+ * @run main/othervm HTTPSetAuthenticatorTest BASICSERVER SERVER307
+ *
+ * @author danielfuchs
+ */
+public class HTTPSetAuthenticatorTest extends HTTPTest {
+
+    public static void main(String[] args) throws Exception {
+        String[] schemes;
+        String[] params;
+         if (args == null || args.length == 0) {
+            schemes = Stream.of(HttpSchemeType.values())
+                        .map(HttpSchemeType::name)
+                        .collect(Collectors.toList())
+                        .toArray(new String[0]);
+            params = new String[0];
+        } else {
+            schemes = new String[] { args[0] };
+            params = Arrays.copyOfRange(args, 1, args.length);
+        }
+        for (String scheme : schemes) {
+            System.out.println("==== Testing with scheme=" + scheme + " ====\n");
+            new HTTPSetAuthenticatorTest(HttpSchemeType.valueOf(scheme))
+                .execute(params);
+            System.out.println();
+        }
+    }
+
+    final HttpSchemeType scheme;
+    public HTTPSetAuthenticatorTest(HttpSchemeType scheme) {
+        this.scheme = scheme;
+    }
+
+    @Override
+    public HttpSchemeType getHttpSchemeType() {
+        return scheme;
+    }
+
+    @Override
+    public int run(HTTPTestServer server,
+                   HttpProtocolType protocol,
+                   HttpAuthType mode)
+            throws IOException
+    {
+        HttpTestAuthenticator authOne = new HttpTestAuthenticator("authOne", "dublin", "foox");
+        HttpTestAuthenticator authTwo = new HttpTestAuthenticator("authTwo", "dublin", "foox");
+        int expectedIncrement = scheme == HttpSchemeType.NONE
+                                ? 0 : EXPECTED_AUTH_CALLS_PER_TEST;
+        int count;
+        int defaultCount = AUTHENTICATOR.count.get();
+        // Connect to the server with a GET request, then with a
+        // POST that contains "Hello World!"
+        // Uses authenticator #1
+        System.out.println("\nClient: Using authenticator #1: "
+            + toString(authOne));
+        HTTPTestClient.connect(protocol, server, mode, authOne);
+        count = authOne.count.get();
+        if (count != expectedIncrement) {
+            throw new AssertionError("Authenticator #1 called " + count(count)
+                + " expected it to be called " + expected(expectedIncrement));
+        }
+
+        // Connect to the server with a GET request, then with a
+        // POST that contains "Hello World!"
+        // Uses authenticator #2
+        System.out.println("\nClient: Using authenticator #2: "
+            + toString(authTwo));
+        HTTPTestClient.connect(protocol, server, mode, authTwo);
+        count = authTwo.count.get();
+        if (count != expectedIncrement) {
+            throw new AssertionError("Authenticator #2 called " + count(count)
+                + " expected it to be called " + expected(expectedIncrement));
+        }
+
+        // Connect to the server with a GET request, then with a
+        // POST that contains "Hello World!"
+        // Uses authenticator #1
+        System.out.println("\nClient: Using authenticator #1 again: "
+            + toString(authOne));
+        HTTPTestClient.connect(protocol, server, mode, authOne);
+        count = authOne.count.get();
+        if (count != expectedIncrement) {
+            throw new AssertionError("Authenticator #1 called " + count(count)
+                + " expected it to be called " + expected(expectedIncrement));
+        }
+        count = authTwo.count.get();
+        if (count != expectedIncrement) {
+            throw new AssertionError("Authenticator #2 called " + count(count)
+                + " expected it to be called " + expected(expectedIncrement));
+        }
+        count =  AUTHENTICATOR.count.get();
+        if (count != defaultCount) {
+            throw new AssertionError("Default Authenticator called " + count(count)
+                + " expected it to be called " + expected(defaultCount));
+        }
+
+        // Now tries with the default authenticator: it should be invoked.
+        System.out.println("\nClient: Using the default authenticator: "
+            + toString(null));
+        HTTPTestClient.connect(protocol, server, mode, null);
+        count = authOne.count.get();
+        if (count != expectedIncrement) {
+            throw new AssertionError("Authenticator #1 called " + count(count)
+                + " expected it to be called " + expected(expectedIncrement));
+        }
+        count = authTwo.count.get();
+        if (count != expectedIncrement) {
+            throw new AssertionError("Authenticator #2 called " + count(count)
+                + " expected it to be called " + expected(expectedIncrement));
+        }
+        count =  AUTHENTICATOR.count.get();
+        if (count != defaultCount + expectedIncrement) {
+            throw new AssertionError("Default Authenticator called " + count(count)
+                + " expected it to be called " + expected(defaultCount + expectedIncrement));
+        }
+
+        // Now tries with explicitly setting the default authenticator: it should
+        // be invoked again.
+        // Uncomment the code below when 8169068 is available.
+        System.out.println("\nClient: Explicitly setting the default authenticator: "
+            + toString(Authenticator.getDefault()));
+        HTTPTestClient.connect(protocol, server, mode, Authenticator.getDefault());
+        count = authOne.count.get();
+        if (count != expectedIncrement) {
+            throw new AssertionError("Authenticator #1 called " + count(count)
+                + " expected it to be called " + expected(expectedIncrement));
+        }
+        count = authTwo.count.get();
+        if (count != expectedIncrement) {
+            throw new AssertionError("Authenticator #2 called " + count(count)
+                + " expected it to be called " + expected(expectedIncrement));
+        }
+        count =  AUTHENTICATOR.count.get();
+        if (count != defaultCount + 2 * expectedIncrement) {
+            throw new AssertionError("Default Authenticator called " + count(count)
+                + " expected it to be called "
+                + expected(defaultCount + 2 * expectedIncrement));
+        }
+
+        // Now tries to set an authenticator on a connected connection.
+        URL url = url(protocol,  server.getAddress(), "/");
+        Proxy proxy = proxy(server, mode);
+        HttpURLConnection conn = openConnection(url, mode, proxy);
+        try {
+            conn.setAuthenticator(null);
+            throw new RuntimeException("Expected NullPointerException"
+                    + " trying to set a null authenticator"
+                    + " not raised.");
+        } catch (NullPointerException npe) {
+            System.out.println("Client: caught expected NPE"
+                    + " trying to set a null authenticator: "
+                    + npe);
+        }
+        conn.connect();
+        try {
+            try {
+                conn.setAuthenticator(authOne);
+                throw new RuntimeException("Expected IllegalStateException"
+                        + " trying to set an authenticator after connect"
+                        + " not raised.");
+            } catch (IllegalStateException ise) {
+                System.out.println("Client: caught expected ISE"
+                        + " trying to set an authenticator after connect: "
+                        + ise);
+            }
+            // Uncomment the code below when 8169068 is available.
+            try {
+                conn.setAuthenticator(Authenticator.getDefault());
+                throw new RuntimeException("Expected IllegalStateException"
+                        + " trying to set an authenticator after connect"
+                        + " not raised.");
+            } catch (IllegalStateException ise) {
+                System.out.println("Client: caught expected ISE"
+                        + " trying to set an authenticator after connect: "
+                        + ise);
+            }
+            try {
+                conn.setAuthenticator(null);
+                throw new RuntimeException("Expected"
+                        + " IllegalStateException or NullPointerException"
+                        + " trying to set a null authenticator after connect"
+                        + " not raised.");
+            } catch (IllegalStateException | NullPointerException xxe) {
+                System.out.println("Client: caught expected "
+                        + xxe.getClass().getSimpleName()
+                        + " trying to set a null authenticator after connect: "
+                        + xxe);
+            }
+        } finally {
+            conn.disconnect();
+        }
+
+        // double check that authOne and authTwo haven't been invoked.
+        count = authOne.count.get();
+        if (count != expectedIncrement) {
+            throw new AssertionError("Authenticator #1 called " + count(count)
+                + " expected it to be called " + expected(expectedIncrement));
+        }
+        count = authTwo.count.get();
+        if (count != expectedIncrement) {
+            throw new AssertionError("Authenticator #2 called " + count(count)
+                + " expected it to be called " + expected(expectedIncrement));
+        }
+
+        // All good!
+        // return the number of times the default authenticator is supposed
+        // to have been called.
+        return scheme == HttpSchemeType.NONE ? 0 : 2 * EXPECTED_AUTH_CALLS_PER_TEST;
+    }
+
+    static String toString(Authenticator a) {
+        return a == null ? "null" : a.toString();
+    }
+
+}

test/jdk/java/net/HttpURLConnection/SetAuthenticator/HTTPTest.java

@@ -0,0 +1,306 @@
+/*
+ * Copyright (c) 2016, 2026, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.net.Authenticator;
+import java.net.HttpURLConnection;
+import java.net.InetSocketAddress;
+import java.net.MalformedURLException;
+import java.net.PasswordAuthentication;
+import java.net.Proxy;
+import java.net.URL;
+import java.util.Locale;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import java.util.stream.Stream;
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSession;
+import jdk.test.lib.net.SimpleSSLContext;
+import static java.net.Proxy.NO_PROXY;
+
+/*
+ * @test
+ * @bug 8169415
+ * @library /test/lib
+ * @modules java.logging
+ *          java.base/sun.net.www
+ *          jdk.httpserver/sun.net.httpserver
+ * @build jdk.test.lib.net.SimpleSSLContext HTTPTest HTTPTestServer HTTPTestClient
+ * @summary A simple HTTP test that starts an echo server supporting Digest
+ *          authentication, then starts a regular HTTP client to invoke it.
+ *          The client first does a GET request on "/", then follows on
+ *          with a POST request that sends "Hello World!" to the server.
+ *          The client expects to receive "Hello World!" in return.
+ *          The test supports several execution modes:
+ *            SERVER: The server performs Digest Server authentication;
+ *            PROXY:  The server pretends to be a proxy and performs
+ *                    Digest Proxy authentication;
+ *            SERVER307: The server redirects the client (307) to another
+ *                    server that perform Digest authentication;
+ *            PROXY305: The server attempts to redirect
+ *                    the client to a proxy using 305 code;
+ * @run main/othervm -Dtest.debug=true -Dtest.digest.algorithm=SHA-512 HTTPTest SERVER
+ * @run main/othervm -Dtest.debug=true -Dtest.digest.algorithm=SHA-256 HTTPTest SERVER
+ * @run main/othervm -Dtest.debug=true -Dhttp.auth.digest.reEnabledAlgorithms=MD5 HTTPTest SERVER
+ * @run main/othervm -Dtest.debug=true -Dhttp.auth.digest.reEnabledAlgorithms=MD5 HTTPTest PROXY
+ * @run main/othervm -Dtest.debug=true -Dhttp.auth.digest.reEnabledAlgorithms=MD5 HTTPTest SERVER307
+ * @run main/othervm -Dtest.debug=true -Dhttp.auth.digest.reEnabledAlgorithms=MD5 HTTPTest PROXY305
+ *
+ * @author danielfuchs
+ */
+public class HTTPTest {
+    public static final boolean DEBUG =
+         Boolean.parseBoolean(System.getProperty("test.debug", "false"));
+    public static enum HttpAuthType { SERVER, PROXY, SERVER307, PROXY305 };
+    public static enum HttpProtocolType { HTTP, HTTPS };
+    public static enum HttpSchemeType { NONE, BASICSERVER, BASIC, DIGEST };
+    public static final HttpAuthType DEFAULT_HTTP_AUTH_TYPE = HttpAuthType.SERVER;
+    public static final HttpProtocolType DEFAULT_PROTOCOL_TYPE = HttpProtocolType.HTTP;
+    public static final HttpSchemeType DEFAULT_SCHEME_TYPE = HttpSchemeType.DIGEST;
+
+    public static class HttpTestAuthenticator extends Authenticator {
+        private final String realm;
+        private final String username;
+        // Used to prevent incrementation of 'count' when calling the
+        // authenticator from the server side.
+        private final ThreadLocal<Boolean> skipCount = new ThreadLocal<>();
+        // count will be incremented every time getPasswordAuthentication()
+        // is called from the client side.
+        final AtomicInteger count = new AtomicInteger();
+        private final String name;
+
+        public HttpTestAuthenticator(String name, String realm, String username) {
+            this.name = name;
+            this.realm = realm;
+            this.username = username;
+        }
+
+        @Override
+        protected PasswordAuthentication getPasswordAuthentication() {
+            if (skipCount.get() == null || skipCount.get().booleanValue() == false) {
+                System.out.println("Authenticator " + name + " called: " + count.incrementAndGet());
+            }
+            return new PasswordAuthentication(getUserName(),
+                    new char[] {'b','a','r'});
+        }
+
+        // Called by the server side to get the password of the user
+        // being authentified.
+        public final char[] getPassword(String user) {
+            if (user.equals(username)) {
+                skipCount.set(Boolean.TRUE);
+                try {
+                    return getPasswordAuthentication().getPassword();
+                } finally {
+                    skipCount.set(Boolean.FALSE);
+                }
+            }
+            throw new SecurityException("User unknown: " + user);
+        }
+
+        @Override
+        public String toString() {
+            return super.toString() + "[name=\"" + name + "\"]";
+        }
+
+        public final String getUserName() {
+            return username;
+        }
+        public final String getRealm() {
+            return realm;
+        }
+
+    }
+    public static final HttpTestAuthenticator AUTHENTICATOR;
+    static {
+        AUTHENTICATOR = new HttpTestAuthenticator("AUTHENTICATOR","dublin", "foox");
+        Authenticator.setDefault(AUTHENTICATOR);
+    }
+
+    static {
+        HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
+            public boolean verify(String hostname, SSLSession session) {
+                return true;
+            }
+        });
+        SSLContext.setDefault(SimpleSSLContext.findSSLContext());
+    }
+
+    static final Logger logger = Logger.getLogger ("com.sun.net.httpserver");
+    static {
+        if (DEBUG) logger.setLevel(Level.ALL);
+        Stream.of(Logger.getLogger("").getHandlers())
+              .forEach(h -> h.setLevel(Level.ALL));
+    }
+
+    static final int EXPECTED_AUTH_CALLS_PER_TEST = 1;
+
+    public static void main(String[] args) throws Exception {
+        // new HTTPTest().execute(HttpAuthType.SERVER.name());
+        new HTTPTest().execute(args);
+    }
+
+    public void execute(String... args) throws Exception {
+        Stream<HttpAuthType> modes;
+        if (args == null || args.length == 0) {
+            modes = Stream.of(HttpAuthType.values());
+        } else {
+            modes = Stream.of(args).map(HttpAuthType::valueOf);
+        }
+        modes.forEach(this::test);
+        System.out.println("Test PASSED - Authenticator called: "
+                 + expected(AUTHENTICATOR.count.get()));
+    }
+
+    public void test(HttpAuthType mode) {
+        for (HttpProtocolType type: HttpProtocolType.values()) {
+            test(type, mode);
+        }
+    }
+
+    public HttpSchemeType getHttpSchemeType() {
+        return DEFAULT_SCHEME_TYPE;
+    }
+
+    public void test(HttpProtocolType protocol, HttpAuthType mode) {
+        if (mode == HttpAuthType.PROXY305 && protocol == HttpProtocolType.HTTPS ) {
+            // silently skip unsupported test combination
+            return;
+        }
+        String digestalg = System.getProperty("test.digest.algorithm");
+        if (digestalg == null || "".equals(digestalg))
+            digestalg = "MD5";
+
+        System.out.println("\n**** Testing " + protocol + " "
+                           + mode + " mode ****\n");
+        int authCount = AUTHENTICATOR.count.get();
+        int expectedIncrement = 0;
+        try {
+            // Creates an HTTP server that echoes back whatever is in the
+            // request body.
+            HTTPTestServer server =
+                    HTTPTestServer.create(protocol,
+                                          mode,
+                                          AUTHENTICATOR,
+                                          getHttpSchemeType(),
+                                          null,
+                                          digestalg);
+            try {
+                expectedIncrement += run(server, protocol, mode);
+            } finally {
+                server.stop();
+            }
+        }  catch (IOException ex) {
+            ex.printStackTrace(System.err);
+            throw new UncheckedIOException(ex);
+        }
+        int count = AUTHENTICATOR.count.get();
+        if (count != authCount + expectedIncrement) {
+            throw new AssertionError("Authenticator called " + count(count)
+                        + " expected it to be called "
+                        + expected(authCount + expectedIncrement));
+        }
+    }
+
+    /**
+     * Runs the test with the given parameters.
+     * @param server    The server
+     * @param protocol  The protocol (HTTP/HTTPS)
+     * @param mode      The mode (PROXY, SERVER, SERVER307...)
+     * @return The number of times the default authenticator should have been
+     *         called.
+     * @throws IOException in case of connection or protocol issues
+     */
+    public int run(HTTPTestServer server,
+                   HttpProtocolType protocol,
+                   HttpAuthType mode)
+            throws IOException
+    {
+        // Connect to the server with a GET request, then with a
+        // POST that contains "Hello World!"
+        HTTPTestClient.connect(protocol, server, mode, null);
+        // return the number of times the default authenticator is supposed
+        // to have been called.
+        return EXPECTED_AUTH_CALLS_PER_TEST;
+    }
+
+    public static String count(int count) {
+        switch(count) {
+            case 0: return "not even once";
+            case 1: return "once";
+            case 2: return "twice";
+            default: return String.valueOf(count) + " times";
+        }
+    }
+
+    public static String expected(int count) {
+        switch(count) {
+            default: return count(count);
+        }
+    }
+    public static String protocol(HttpProtocolType type) {
+        return type.name().toLowerCase(Locale.US);
+    }
+
+    public static URL url(HttpProtocolType protocol, InetSocketAddress address,
+                          String path) throws MalformedURLException {
+        return new URL(protocol(protocol),
+                       address.getAddress().getHostAddress(),
+                       address.getPort(), path);
+    }
+
+    public static Proxy proxy(HTTPTestServer server, HttpAuthType authType) {
+        if (authType != HttpAuthType.PROXY) return null;
+
+        InetSocketAddress proxyAddress = server.getProxyAddress();
+        if (!proxyAddress.isUnresolved()) {
+            // Forces the proxy to use an unresolved address created
+            // from the actual IP address to avoid using the proxy
+            // address hostname which would result in resolving to
+            // a posibly different address. For instance we want to
+            // avoid cases such as:
+            //    ::1 => "localhost" => 127.0.0.1
+            proxyAddress = InetSocketAddress.
+                createUnresolved(proxyAddress.getAddress().getHostAddress(),
+                                 proxyAddress.getPort());
+        }
+
+        return new Proxy(Proxy.Type.HTTP, proxyAddress);
+    }
+
+    public static HttpURLConnection openConnection(URL url,
+                                                   HttpAuthType authType,
+                                                   Proxy proxy)
+                                    throws IOException {
+
+        HttpURLConnection conn = (HttpURLConnection)
+                (authType == HttpAuthType.PROXY
+                    ? url.openConnection(proxy)
+                    : url.openConnection(NO_PROXY));
+        return conn;
+    }
+}

test/jdk/java/net/HttpURLConnection/SetAuthenticator/HTTPTestClient.java

@@ -0,0 +1,119 @@
+/*
+ * Copyright (c) 2016, 2026, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.IOException;
+import java.net.Authenticator;
+import java.net.BindException;
+import java.net.HttpURLConnection;
+import java.net.InetSocketAddress;
+import java.net.Proxy;
+import java.net.URL;
+import java.time.Duration;
+import javax.net.ssl.HttpsURLConnection;
+
+/**
+ * A simple Http client that connects to the HTTPTestServer.
+ * @author danielfuchs
+ */
+public class HTTPTestClient extends HTTPTest {
+
+    public static final long DELAY_BEFORE_RETRY = 2500; // milliseconds
+
+    public static void connect(HttpProtocolType protocol,
+                               HTTPTestServer server,
+                               HttpAuthType authType,
+                               Authenticator auth)
+            throws IOException {
+        try {
+            doConnect(protocol, server, authType, auth);
+        } catch (BindException ex) {
+            // sleep a bit then try again once
+            System.out.println("WARNING: Unexpected BindException: " + ex);
+            System.out.println("\tSleeping a bit and try again...");
+            long start = System.nanoTime();
+            System.gc();
+            try {
+                Thread.sleep(DELAY_BEFORE_RETRY);
+            } catch (InterruptedException iex) {
+                // ignore
+            }
+            System.gc();
+            System.out.println("\tRetrying after "
+                    + Duration.ofNanos(System.nanoTime() - start).toMillis()
+                    + " milliseconds");
+            doConnect(protocol, server, authType, auth);
+        }
+    }
+
+    public static void doConnect(HttpProtocolType protocol,
+                               HTTPTestServer server,
+                               HttpAuthType authType,
+                               Authenticator auth)
+            throws IOException {
+
+        InetSocketAddress address = server.getAddress();
+        final URL url = url(protocol,  address, "/");
+        final Proxy proxy = proxy(server, authType);
+
+        System.out.println("Client: FIRST request: " + url + " GET");
+        HttpURLConnection conn = openConnection(url, authType, proxy);
+        configure(conn, auth);
+        System.out.println("Response code: " + conn.getResponseCode());
+        String result = new String(conn.getInputStream().readAllBytes(), "UTF-8");
+        System.out.println("Response body: " + result);
+        if (!result.isEmpty()) {
+            throw new RuntimeException("Unexpected response to GET: " + result);
+        }
+        System.out.println("\nClient: NEXT request: " + url + " POST");
+        conn = openConnection(url, authType, proxy);
+        configure(conn, auth);
+        conn.setRequestMethod("POST");
+        conn.setDoOutput(true);
+        conn.setDoInput(true);
+        conn.getOutputStream().write("Hello World!".getBytes("UTF-8"));
+        System.out.println("Response code: " + conn.getResponseCode());
+        result = new String(conn.getInputStream().readAllBytes(), "UTF-8");
+        System.out.println("Response body: " + result);
+        if ("Hello World!".equals(result)) {
+            System.out.println("Test passed!");
+        } else {
+            throw new RuntimeException("Unexpected response to POST: " + result);
+        }
+    }
+
+    private static void configure(HttpURLConnection conn, Authenticator auth)
+        throws IOException {
+        if (auth != null) {
+            conn.setAuthenticator(auth);
+        }
+        if (conn instanceof HttpsURLConnection) {
+            System.out.println("Client: configuring SSL connection");
+            // We have set a default SSLContext so we don't need to do
+            // anything here. Otherwise it could look like:
+            //     HttpsURLConnection httpsConn = (HttpsURLConnection)conn;
+            //     httpsConn.setSSLSocketFactory(
+            //               SimpleSSLContext.findSSLContext().getSocketFactory());
+        }
+    }
+
+}