HTTPCLIENT-2277: RFC 9111 conformance improvements / bug fixes

httpclient5-cache/src/main/java/org/apache/hc/client5/http/cache/HttpCacheEntry.java

@@ -342,6 +342,13 @@ public Iterator<Header> headerIterator(final String name) {
         return responseHeaders.headerIterator(name);
     }
 
+    /**
+     * @since 5.3
+     */
+    public MessageHeaders responseHeaders() {
+        return responseHeaders;
+    }
+
     /**
      * Gets the Date value of the "Date" header or null if the header is missing or cannot be
      * parsed.
@@ -440,13 +447,27 @@ public String getRequestURI() {
         return requestURI;
     }
 
+    /**
+     * @since 5.3
+     */
+    public MessageHeaders requestHeaders() {
+        return requestHeaders;
+    }
+
     /**
      * @since 5.3
      */
     public Iterator<Header> requestHeaderIterator() {
         return requestHeaders.headerIterator();
     }
 
+    /**
+     * @since 5.3
+     */
+    public Iterator<Header> requestHeaderIterator(final String headerName) {
+        return requestHeaders.headerIterator(headerName);
+    }
+
     /**
      * Tests if the given {@link HttpCacheEntry} is newer than the given {@link MessageHeaders}
      * by comparing values of their {@literal DATE} header. In case the given entry, or the message,

httpclient5-cache/src/main/java/org/apache/hc/client5/http/cache/HttpCacheEntryFactory.java

@@ -212,6 +212,8 @@ public HttpCacheEntry create(final Instant requestInstant,
         final String s = CacheKeyGenerator.getRequestUri(host, request);
         final URI uri = CacheKeyGenerator.normalize(s);
         final HeaderGroup requestHeaders = filterHopByHopHeaders(request);
+        // Strip AUTHORIZATION from request headers
+        requestHeaders.removeHeaders(HttpHeaders.AUTHORIZATION);
         final HeaderGroup responseHeaders = filterHopByHopHeaders(response);
         ensureDate(responseHeaders, responseInstant);
         return new HttpCacheEntry(
@@ -232,12 +234,16 @@ public HttpCacheEntry create(final Instant requestInstant,
      *
      * @param requestInstant   Date/time when the request was made (Used for age calculations)
      * @param responseInstant  Date/time that the response came back (Used for age calculations)
+     * @param host             Target host
+     * @param request          Original client request (a deep copy of this object is made)
      * @param response         Origin response (a deep copy of this object is made)
      * @param entry            Existing cache entry.
      */
     public HttpCacheEntry createUpdated(
             final Instant requestInstant,
             final Instant responseInstant,
+            final HttpHost host,
+            final HttpRequest request,
             final HttpResponse response,
             final HttpCacheEntry entry) {
         Args.notNull(requestInstant, "Request instant");
@@ -249,13 +255,18 @@ public HttpCacheEntry createUpdated(
         if (HttpCacheEntry.isNewer(entry, response)) {
             return entry;
         }
+        final String s = CacheKeyGenerator.getRequestUri(host, request);
+        final URI uri = CacheKeyGenerator.normalize(s);
+        final HeaderGroup requestHeaders = filterHopByHopHeaders(request);
+        // Strip AUTHORIZATION from request headers
+        requestHeaders.removeHeaders(HttpHeaders.AUTHORIZATION);
         final HeaderGroup mergedHeaders = mergeHeaders(entry, response);
         return new HttpCacheEntry(
                 requestInstant,
                 responseInstant,
-                entry.getRequestMethod(),
-                entry.getRequestURI(),
-                headers(entry.requestHeaderIterator()),
+                request.getMethod(),
+                uri.toASCIIString(),
+                requestHeaders,
                 entry.getStatus(),
                 mergedHeaders,
                 entry.getResource(),