RFR: 8304818: Prune HttpURLConnection cache when corresponding Authenticator is garbage collected [v3]

[Michael McMahon]

On Mon, 27 Mar 2023 09:05:17 GMT, Michael McMahon <michaelm at openjdk.org> wrote:

>> Hi,
>> 
>> Can I get a review for this please? This change uses a Cleaner to check when java.net.Authenticator instances become unreachable, and then prunes the authentication cache for entries that correspond to that Authenticator and therefore cannot be used again. This stops the authentication cache from growing in size unbounded. Note, this only happens in the probably unusual case where more than one Authenticator object is used. Normally there is no reason to use more than one instance.
>> 
>> Thanks,
>> Michael.
>
> Michael McMahon has updated the pull request incrementally with one additional commit since the last revision:
> 
>   review updates

I've just pushed a re-implementation of the underlying authenticator keys mechanism together with this fix. There are still a few loose ends:
- behavior when the default Authenticator is changed (may need to be specified)
- serialization of AuthCacheImpl (doesn't seem to be possible for user code to do this. So, maybe consider removing)
- initialization of shared secrets usage (currently by instantiating a dummy Authenticator)

-------------

PR Comment: https://git.openjdk.org/jdk/pull/13159#issuecomment-1494152118