[logback-dev] [JIRA] (LOGBACK-1574) No SSL hostname verification

[QOS.CH (JIRA)]

Title: Message Title

Bruno Harbulot commented on LOGBACK-1574   Re: No SSL hostname verification Thanks for merging these PR! It looks like the end result is a mix of PR 305 and PR 534. The initial PR 305 was calling the parameter "disableHostnameVerification", with the implication it would be enabled by default when nothing was set. PR 534 called it "enabledHostnameVerification", but used Boolean.TRUE as its default value. As I've just commented on PR 305, it seems that the latest patch simply calls the parameter "hostnameVerification", but the default value is null the verification settings would not be called at all unless users set it explicitly to true. Obviously, it's design choice and there's no right or wrong, but I think this security setting should be enabled by default, otherwise the vulnerability is still effectively present unless users have actively enabled that parameter. Add Comment   This message was sent by Atlassian Jira (v8.8.0#808000-sha1:e2c7e59)

_______________________________________________
logback-dev mailing list
logback-dev@qos.ch
http://mailman.qos.ch/mailman/listinfo/logback-dev