SpectoLabs / hoverfly-java

Java binding for Hoverfly
Apache License 2.0
168 stars 58 forks source link

Supporting proxy authentication #67

Open tommysitu opened 7 years ago

tommysitu commented 7 years ago

When connecting to remote hoverfly instance, it is likely that the authentication is enabled:

https://docs.hoverfly.io/en/stable/pages/tutorials/advanced/proxyauth/proxyauth.html#proxyauth

The remote hoverfly instance config should allow user to provide username and password for the basic authentication of the hoverfly proxy.

simomo commented 7 years ago

Hi Tommy, I'm starting to working on this issue. I was super busy in these weeks~~

After studying the code, here is a draft in my mind:

  1. add username and password fields in the HoverflyConfig class;
  2. find the place where hoverfly builds the request, add codes for setting basic HTTP auth.

Please feel free to add comments, they will be very helpful :)

Thanks

mogronalol commented 7 years ago

Hi Simono,

Thanks for this. I had a look at this stackoverflow which shows how to do it use an authenticator implementation.

Unfortunately, it doesn't look like it can be done with system properties only, which is a bit annoying.

The config suggestion with a username and password looks good to me. My other suggestion would be to support environment variables as well, this way people would be less likely to commit the password.

tommysitu commented 7 years ago

@simomo thank you for looking into this.

On top of what you and @mogronalol suggested:

  1. Supporting environment variable is a good idea. If username or password is not provided, it will try to look for HOVERFLY_USERNAME and HOVERFLY_PASSWORD using System.getenv()
  2. Don't forget validation, which can be done in HoverflyConfigValidator
  3. The Hoverfly client will require basic authentication to interact with the Hoverfly API. For the sake of simplifying testing, it may be worth it to extract HoverflyClient.java from Hoverfly.java. As you can see Hoverfly.java is growing big quickly, there are lots of duplicated error handling logic.