authenticateSession always receives a null byte array password

[EltonSaraci99]

I am trying to implement the ServerEvents method "authenticateSession" to provide an authentication layer for my backend anytime a charge point tries to connect. The method that I am talking about:

`@Override
public void authenticateSession(SessionInformation sessionInformation, String s, byte[] bytes) throws AuthenticationException {

			log.info("identifier: " + sessionInformation.getIdentifier());
                             log.info("password in byte array: " + bytes);

		}`

However, for some reason, the password byte array always comes as a null value, despite me adding a password in the charge points that I have (tried with several different wallboxes, choosing basic auth). Is there something I am missing? No exceptions get thrown.

[robert-s-ubi]

This is indeed an issue with this library. It does not implement RFC 2617 fully, which foresees that when the client does not send any authentication, the server responds with HTTP error 401 and specifies which authentication methods it supports.

Some charging stations (e.g. ones which use this library) just put the HTTP Basic Auth password in the first request, and from those, you will get the password in your authenticationSession() implementation.

But other charging stations (e.g. ones which use Tyrus) will NOT initially send the HTTP Basic Auth password, but rather only when they get an HTTP error 401 response with a WWW-Authenticate: Basic header line.

Last time I checked, this could not be solved within this library, as the Java-WebSocket library did not allow sending an HTTP error 401 response, and I don't think this has been resolved yet (see the open PR TooTallNate/Java-WebSocket#1424 in that project), so fixing this issue requires customizing the Java-WebSocket library (or convincing its maintainers to merge this PR).

[elton-saraci]

This is indeed an issue with this library. It does not implement RFC 2617 fully, which foresees that when the client does not send any authentication, the server responds with HTTP error 401 and specifies which authentication methods it supports.

Some charging stations (e.g. ones which use this library) just put the HTTP Basic Auth password in the first request, and from those, you will get the password in your authenticationSession() implementation.

But other charging stations (e.g. ones which use Tyrus) will NOT initially send the HTTP Basic Auth password, but rather only when they get an HTTP error 401 response with a WWW-Authenticate: Basic header line.

Last time I checked, this could not be solved within this library, as the Java-WebSocket library did not allow sending an HTTP error 401 response, and I don't think this has been resolved yet (see the open PR TooTallNate/Java-WebSocket#1424 in that project), so fixing this issue requires customizing the Java-WebSocket library (or convincing its maintainers to merge this PR).

True! I ended up fixing it in the network layer.