For thread safety, define gssContext, token, negotiationOid as local variables instead of class attributes. (gssContext must not be thread safe as it makes NPE under load)

Author: fabienbancharel

src/main/java/com/ning/http/client/providers/netty/spnego/SpnegoEngine.java

@@ -62,15 +62,6 @@ public class SpnegoEngine {
 
     private final SpnegoTokenGenerator spnegoGenerator;
 
-    private GSSContext gssContext = null;
-
-    /**
-     * base64 decoded challenge *
-     */
-    private byte[] token;
-
-    private Oid negotiationOid = null;
-
     public SpnegoEngine(final SpnegoTokenGenerator spnegoGenerator) {
         this.spnegoGenerator = spnegoGenerator;
     }
@@ -80,6 +71,9 @@ public SpnegoEngine() {
     }
 
     public String generateToken(String server) throws Throwable {
+        GSSContext gssContext = null;
+        byte[] token = null; // base64 decoded challenge
+        Oid negotiationOid = null;
 
         try {
             log.debug("init {}", server);