I'm reading up on how Bearer auth works with Ktor ...

# ktor

[Sam]

I'm reading up on how Bearer auth works with Ktor client. Am I correct that, notwithstanding a sendWithoutRequest block, it looks for a 401 response with a WWW-Authenticate header with a matching realm and then sends that token? Is there any way to short-circuit or restrict that?

[Aleksei Tirman [JB]]

If the sendWithoutRequest returns true an initial request contains the Authorization header with the Bearer token.

[Sam]

Right, but otherwise it looks for that header and sends the matching token right?

[Sam]

I'm asking because I'm wondering if that means that it's a good practice to construct a separate client for each domain you make requests to. Otherwise a compromised domain could just... send a response with a header asking for a token that's not theirs and the client would just... send it.

[Aleksei Tirman [JB]]

Yes, and calls the refreshTokens block to obtain new tokens.

[Aleksei Tirman [JB]]

Can you please give an example?

[Sam]

Like, imagine I have a single client that I use to make requests to Domain A and Domain B, and I have bearer auth configured for each domain with its own realm. If Domain B were compromised they could send a malicious WWW-Authenticate header containing A's realm and the client would automatically send them my token for A.

Basically, there's no way to say "apply this auth provider to ONLY these requests". You can tell it to eagerly send for certain requests, but it always falls back on that header.

[Sam]

This is just hypothetical. Right now I'm only making requests to our own servers. The behavior just struck me as odd.

[Sam]

And made me wonder if the intent is for a different HttpClient to be constructed for each domain

[Sam]

Right now I just make a single client in Koin and share it everywhere

[Aleksei Tirman [JB]]

Right. If you have such a concern, creating a separate client for each domain or manually sending the Authorization header would be the solution.

[Sam]

Fair enough!

[Sam]

It would be nice to have a sendIf or the like to provide a fully custom behavior, but this was just a hypothetical anyway.

Thanks for the chat!

[Rustam Siniukov]

sendWithoutRequest accepts HttpRequestBuilder , you can check which domain the request is made to

[Sam]

Right, but if you return false from that block it will still send the token in response to a 401

[Rustam Siniukov]

only if realm matches (or null)

[Sam]

Right, that's what prompted my question. I'd prefer if I could configure it to send ONLY if the block returns true.