Re: Tomcat Secure WebSockets clients - hostname verification

2019-10-09 Thread Gary Sheppard
On Wed, Oct 9, 2019, 18:11 Gary Sheppard wrote: > On Tue, Jun 12, 2018 at 12:13 Mark Thomas wrote: > > >> It would be very useful to be able to configure this, so if you are > >> going to patch the code, please make this configurable by the client. > >> See HttpsURLConnection.setHostnameVerifier

Re: Tomcat Secure WebSockets clients - hostname verification

2019-10-09 Thread Gary Sheppard
On Tue, Jun 12, 2018 at 12:13 Mark Thomas wrote: >> It would be very useful to be able to configure this, so if you are >> going to patch the code, please make this configurable by the client. >> See HttpsURLConnection.setHostnameVerifier >> >> I think it's appropriate to simply match that API

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-13 Thread tomcat
Thanks, Remy and Chris, for providing this clarification. On 12.06.2018 20:34, Rémy Maucherat wrote: On Tue, Jun 12, 2018 at 7:05 PM André Warnier (tomcat) wrote: This is a bit OT, but I have a question since the beginning of this thread : Is Tomcat really supposed to provide a websocket

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-12 Thread Rémy Maucherat
On Tue, Jun 12, 2018 at 7:05 PM André Warnier (tomcat) wrote: > This is a bit OT, but I have a question since the beginning of this thread > : > Is Tomcat really supposed to provide a websocket *client* API ? > Yes, the client API is part of the websockets EE specification. Initially, Tomcat

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 André, On 6/12/18 1:06 PM, André Warnier (tomcat) wrote: > On 12.06.2018 18:13, Mark Thomas wrote: [snip].. >> >> I'll see what I can do. The major constraint is that all this has >> to be set via Tomcat specific user properties as there is no API

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-12 Thread tomcat
On 12.06.2018 18:13, Mark Thomas wrote: [snip].. I'll see what I can do. The major constraint is that all this has to be set via Tomcat specific user properties as there is no API for in the Java WebSocket API. This is a bit OT, but I have a question since the beginning of this thread : Is

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-12 Thread Mark Thomas
On 12/06/2018 16:12, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 6/11/18 10:31 AM, Mark Thomas wrote: On 11/06/18 11:47, Weiner Harald wrote: What are your thoughts? I'm leaning towards adding: SSLParameters sslParams = new SSLParameters();

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 6/11/18 10:31 AM, Mark Thomas wrote: > On 11/06/18 11:47, Weiner Harald wrote: > > > >> What are your thoughts? > > I'm leaning towards adding: > > SSLParameters sslParams = new SSLParameters(); >

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-11 Thread Mark Thomas
On 11/06/18 11:47, Weiner Harald wrote: > What are your thoughts? I'm leaning towards adding: SSLParameters sslParams = new SSLParameters(); sslParams.setEndpointIdentificationAlgorithm("HTTPS"); sslSocket.setSSLParameters(sslParams); unconditionally to WsWebSocketContainer.createSSLEngine()