WSO2 EI 6.5.0自定义Basic Auth失效，报ArrayIndexOutOfBoundsException异常

问题现象 #

在WSO2 EI 6.5.0中部署自定义Basic Auth处理器后，调用API时触发ArrayIndexOutOfBoundsException，错误堆栈指向CustomBasicAuth.java:73，接口返回500内部服务器错误。

错误原因 #

核心问题是未正确处理Authorization请求头格式：

• HTTP Basic Auth的Authorization头标准格式为Basic <Base64编码的username:password>
• 当前代码直接对整个Authorization头字符串（包含"Basic "前缀）进行Base64解码，导致解码后的内容并非预期的username:password格式
• 调用split(":")后数组长度不足2，触发索引越界异常

修复方案 #

修改CustomBasicAuth类的processSecurity方法，先剥离"Basic "前缀，再解码并增加格式校验：

package com.basic.auth.handler;

import org.apache.commons.codec.binary.Base64;
import org.apache.synapse.MessageContext;
import org.apache.synapse.core.axis2.Axis2MessageContext;
import org.apache.synapse.core.axis2.Axis2Sender;
import org.apache.synapse.rest.Handler;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
  
import java.util.Map;

public class CustomBasicAuth implements Handler {
    private static final Log log = LogFactory.getLog(CustomBasicAuth.class);
     
    public void addProperty(String s, Object o) {
        // 保留原实现
    }
 
    public Map getProperties() {
        return null;  // 保留原实现
    }
 
    public boolean handleRequest(MessageContext messageContext) {
        
        log.info("Inside CustomBasicAuth Class **** ");
 
        org.apache.axis2.context.MessageContext axis2MessageContext
                = ((Axis2MessageContext) messageContext).getAxis2MessageContext();
        Object headers = axis2MessageContext.getProperty(
                org.apache.axis2.context.MessageContext.TRANSPORT_HEADERS);
 
        if (headers != null && headers instanceof Map) {
            Map headersMap = (Map) headers;
            if (headersMap.get("Authorization") == null) {
                headersMap.clear();
                axis2MessageContext.setProperty("HTTP_SC", "401");
                headersMap.put("WWW-Authenticate", "Basic realm=\"WSO2 ESB\"");
                axis2MessageContext.setProperty("NO_ENTITY_BODY", Boolean.TRUE);
                messageContext.setProperty("RESPONSE", "true");
                messageContext.setTo(null);
                Axis2Sender.sendBack(messageContext);
                return false;
 
            } else {
                String authHeader = (String) headersMap.get("Authorization");
                if (processSecurity(authHeader)) {
                    return true;
                } else {
                    headersMap.clear();
                    axis2MessageContext.setProperty("HTTP_SC", "403");
                    axis2MessageContext.setProperty("NO_ENTITY_BODY", Boolean.TRUE);
                    messageContext.setProperty("RESPONSE", "true");
                    messageContext.setTo(null);
                    Axis2Sender.sendBack(messageContext);
                    return false;
                }
            }
        }
        return false;
    }
  
    public boolean handleResponse(MessageContext messageContext) {
        return true;
    }
 
    public boolean processSecurity(String credentials) {
        log.info("raw auth header**** " + credentials);
        
        // 校验Authorization头格式合法性
        if (credentials == null || !credentials.startsWith("Basic ")) {
            log.warn("Invalid Authorization header format");
            return false;
        }
        
        // 剥离"Basic "前缀，提取Base64编码内容
        String base64Credentials = credentials.substring(6).trim();
        String decodedCredentials = new String(Base64.decodeBase64(base64Credentials));
  
        log.info("decoded Credentials**** " + decodedCredentials);
        
        // 分割用户名和密码，校验格式完整性
        String[] authParts = decodedCredentials.split(":");
        if (authParts.length != 2) {
            log.warn("Invalid decoded credentials format");
            return false;
        }
        
        String username = authParts[0];
        String password = authParts[1];
        return "wso2user".equals(username) && "wso2user".equals(password);
    }   
}

后续操作 #

1. 重新编译修改后的代码，生成新的jar包
2. 替换<WSO2EI_HOME>/lib目录中的旧jar文件
3. 重启WSO2 EI服务
4. 使用Postman重新测试API请求

内容的提问来源于stack exchange，提问作者Justin