From b73faca4527cc88df455ebe945d758cf04556ebb Mon Sep 17 00:00:00 2001
From: Michael McMahon <michaelm@openjdk.org>
Date: Mon, 16 Dec 2019 16:44:03 +0000
Subject: [PATCH] 8235976: Directives in WWW-Authenticate should be comma
 separated

Reviewed-by: chegar
---
 .../sun/net/httpserver/BasicAuthenticator.java   | 16 +++++++++-------
 .../net/httpserver/bugs/8199849/ParamTest.java   | 10 +++++-----
 2 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/src/jdk.httpserver/share/classes/com/sun/net/httpserver/BasicAuthenticator.java b/src/jdk.httpserver/share/classes/com/sun/net/httpserver/BasicAuthenticator.java
index 86831501c6..c8c54bb873 100644
--- a/src/jdk.httpserver/share/classes/com/sun/net/httpserver/BasicAuthenticator.java
+++ b/src/jdk.httpserver/share/classes/com/sun/net/httpserver/BasicAuthenticator.java
@@ -95,10 +95,7 @@ public abstract class BasicAuthenticator extends Authenticator {
          */
         String auth = rmap.getFirst ("Authorization");
         if (auth == null) {
-            Headers map = t.getResponseHeaders();
-            var authString = "Basic realm=" + "\"" + realm + "\"" +
-                (isUTF8 ? " charset=\"UTF-8\"" : "");
-            map.set ("WWW-Authenticate", authString);
+            setAuthHeader(t);
             return new Authenticator.Retry (401);
         }
         int sp = auth.indexOf (' ');
@@ -119,13 +116,18 @@ public abstract class BasicAuthenticator extends Authenticator {
             );
         } else {
             /* reject the request again with 401 */
-
-            Headers map = t.getResponseHeaders();
-            map.set ("WWW-Authenticate", "Basic realm=" + "\""+realm+"\"");
+            setAuthHeader(t);
             return new Authenticator.Failure(401);
         }
     }
 
+    private void setAuthHeader(HttpExchange t) {
+        Headers map = t.getResponseHeaders();
+        var authString = "Basic realm=" + "\"" + realm + "\"" +
+            (isUTF8 ? ", charset=\"UTF-8\"" : "");
+        map.set ("WWW-Authenticate", authString);
+    }
+
     /**
      * called for each incoming request to verify the
      * given name and password in the context of this
diff --git a/test/jdk/com/sun/net/httpserver/bugs/8199849/ParamTest.java b/test/jdk/com/sun/net/httpserver/bugs/8199849/ParamTest.java
index 226f14156c..c030d79a10 100644
--- a/test/jdk/com/sun/net/httpserver/bugs/8199849/ParamTest.java
+++ b/test/jdk/com/sun/net/httpserver/bugs/8199849/ParamTest.java
@@ -32,7 +32,7 @@ import jdk.test.lib.net.URIBuilder;
 
 /**
  * @test
- * @bug 8199849
+ * @bug 8199849 8235976
  * @summary
  * @library /test/lib
  * @run main/othervm ParamTest
@@ -42,10 +42,10 @@ import jdk.test.lib.net.URIBuilder;
 public class ParamTest {
 
     static final String[] variants = {
-        " charset=utf-8",
-        " charset=UtF-8",
-        " charset=\"utF-8\"",
-        " charset=\"UtF-8\""
+        " ,charset=utf-8",
+        " ,charset=UtF-8",
+        " ,charset=\"utF-8\"",
+        " ,charset=\"UtF-8\""
     };
 
     static final int LOOPS = variants.length;