java.io.IOException : No authentication challenges found

Question

I am newbie to android and this is my first project on android. I am struggling with "authentication" problem for more than a day. I tried several options but none of them worked.

Basically, I want to call a REST API and get response. I am sure that there is no problem in API as I use the same one in another iOS application.

I pass authorization header but still authentication no found message is shown. I found few question on stackoverflow related to this, but some of them did not work and some does not make sense to me.

I get status code 401. I know this means either no authentication passed or if passed, then they are wrong. Here, I am sure my passed ones are correct.

Below is my code :

try {
    url = new URL(baseUrl);
}
catch (MalformedURLException me) {
     Log.e(TAG, "URL could not be parsed. URL : " + baseUrl + ". Line : " + getLineNumber(), me);
     me.printStackTrace();
}

try {
    urlConnection = (HttpURLConnection) url.openConnection();
    urlConnection.setRequestMethod(method); 
    urlConnection.setConnectTimeout(TIMEOUT * 1000);
    urlConnection.setChunkedStreamingMode(0);

    // Set HTTP headers                 
    String authString = "username:password";
    String base64Auth = Base64.encodeToString(authString.getBytes(), Base64.DEFAULT);
    urlConnection.setRequestProperty("Authorization", "Basic " + base64Auth);
    urlConnection.setRequestProperty("Accept", "application/json");
    urlConnection.setRequestProperty("Content-type", "application/json");

    if (method.equals("POST") || method.equals("PUT")) {
        // Set to true when posting data
        urlConnection.setDoOutput(true);

        // Write data to post to connection output stream
        OutputStream out = urlConnection.getOutputStream();
        out.write(postParameters.getBytes("UTF-8"));
    }

    try {
        // Get response
        in = new BufferedInputStream(urlConnection.getInputStream());
    }
    catch (IOException e) {
        Log.e(TAG, "Exception in getting connection input stream. in : " + in);
                    e.printStackTrace();
    }

    // Read the input stream that has response
    statusCode = urlConnection.getResponseCode();
    Log.d(TAG, "Status code : " + statusCode);
}
catch (ProtocolException pe) {
    pe.printStackTrace();
}
catch (IllegalStateException ie) {
    ie.printStackTrace();
}
catch (IOException e) {
    e.printStackTrace();
}   
finally {
    urlConnection.disconnect();
}

Look at screenshot of logcat :

Any help would be appreciated. Thank you.

Answer 1

This error happens because the server sends a 401 (Unauthorized) but does not give a WWW-Authenticate header which is a hint to the client what to do next. The WWW-Authenticate header tells the client, which kind of authentication is needed (either Basic or Digest). This is probably not very useful in headless http clients, but that's how the HTTP 1.1 RFC is defined. The error occurs because the lib tries to parse the WWW-Authenticate header but can't.

From the RFC:

(...)The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource.(...)

Possible solutions if you can change the server:

• Add a fake "WWW-Authenticate" header like: WWW-Authenticate: Basic realm="fake". This is a mere workaround not a solution, but it should work and the http client is satisfied (see here a discussion of what you can put in the header). But beware that some http clients may automatically retry the request resulting in multiple requests (e.g. increments the wrong login count too often). This was observed with the iOS http client.
• As proposed by loudvchar in this blog to avoid automatic reactions to the challenge like a pop-up login form in a browser, you can use a non-standard authentication method like so: WWW-Authenticate: xBasic realm="fake". The important point is that the realm has to be included.
• Use HTTP status code 403 instead of 401. It's semantic is not the same and usually when working with login 401 is a correct response (see here for a detailed discussion) but the safer solution in terms of compatibility.

Possible solutions if you can't change the server:

• As @ErikZ wrote in his post you could use a try&catch

  HttpURLConnection connection = ...;
  try {
      // Will throw IOException if server responds with 401.
      connection.getResponseCode(); 
  } catch (IOException e) {
      // Will return 401, because now connection has the correct internal state.
      int responsecode = connection.getResponseCode(); 
  }
  

• Use different http client like OkHttp

Answer 2

What version of Android are you testing on?

I had difficulties with the Android authenticator during some development work on Gingerbread (I don't know if it behaves differently on later versions of Android). I used Fiddler2 to examine the HTTP traffic between my app and the server, discovering that the authenticator did not send out the authentication string for every HTTP request. I needed it to.

Instead, I resorted to this:

urlConnection.setRequestProperty("Authorization", "Basic " + Base64.encodeToString("userid:pwd".getBytes(), Base64.NO_WRAP ));

It's a cut-and-paste from my code. Note that urlConnection is an HttpURLConnection object.

Answer 3

I had the same issue on devices running pre-KitKat Android, but I was using the Volley library so the client side fix provided by @for3st didn't work for me, I had to adjust it for Volley, here it is, hope it helps someone struggling with this problem:

HurlStack hurlStack = new HurlStack() {
            @Override
            public HttpResponse performRequest(final Request<?> request, final Map<String, String> additionalHeaders) throws IOException, AuthFailureError {
                try {
                    return super.performRequest(request, additionalHeaders);
                } catch (IOException e) {
                    return new BasicHttpResponse(new ProtocolVersion("HTTP", 1, 1), 401, e.getMessage());
                }
            }
        };

Volley.newRequestQueue(context.getApplicationContext(), hurlStack);

This way a 401 error is returned and your retry policy can do it's job (e.g. request token... etc...). Although IOException could be caused by some other problem, other then a 401, so you could opt for parsing the exception message for Authorization keyword, and return a different response code for others.

Answer 4

Had the same issue on some old devices (Huawei Y330-U11 for instance). Correct way to fix it is to fix it server side as mentioned in the most popular answer.

However, it's really disappointing that the issue occurs only on some devices. And I believe it happens due to different implementations of "UrlConnection". Different Android versions - different "UrlConnection" implementations.

So, you might want to fix it by using the same "UrlConnection" everywhere. Try to use okhttp and okhttp-urlconnection.

Here is the way to add those libs to your gradle build:

compile 'com.squareup.okhttp:okhttp:2.5.0'
compile 'com.squareup.okhttp:okhttp-urlconnection:2.5.0'

It solved the problem for me on those outdated devices. (I had to use OkClient for Retrofit RestAdapter)

P.S. Latest Androids at time of writing use old version of OKHTTP library internally as "UrlConnection" implemetation (with updated package names), so it seems to be quite solid thing

Answer 5

you can use something like this

catch (IOException ex) {
        if(ex.getMessage().toString().toLowerCase().equals(("No authentication challenges found").toLowerCase()))
// re-generate the authentication Token
             }