Apache
/
httpcomponents-client
mirror of https://github.com/apache/httpcomponents-client.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add security warning to TrustStrategy implementations documentation (#490)

This commit is contained in:
Marcono1234 2023-10-03 22:14:12 +02:00 committed by GitHub
parent 19ab1111c7
commit 9c83250ab4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
httpclient5/src/main/java/org/apache/hc/client5/http/ssl/TrustAllStrategy.java
View File

@ -34,9 +34,15 @@ import org.apache.hc.core5.annotation.ThreadingBehavior;
import org.apache.hc.core5.ssl.TrustStrategy;
/**
* A trust strategy that accepts all certificates as trusted. Verification of
* all other certificates is done by the trust manager configured in the SSL
* context.
* A trust strategy that accepts all certificates as trusted.
*
* <h2>Security Warning</h2>
* This trust strategy effectively disables trust verification of SSL / TLS,
* and allows man-in-the-middle attacks. If possible avoid this trust strategy
* and use more secure alternatives. For example, for self-signed certificates
* prefer specifying a keystore containing the certificate chain when calling
* the {@link org.apache.hc.core5.ssl.SSLContextBuilder} {@code loadTrustMaterial}
* methods.
*
* @since 4.5.4
* @since 5.0

10
httpclient5/src/main/java/org/apache/hc/client5/http/ssl/TrustSelfSignedStrategy.java
View File

@ -37,8 +37,18 @@ import org.apache.hc.core5.ssl.TrustStrategy;
* A trust strategy that accepts self-signed certificates as trusted. Verification of all other
* certificates is done by the trust manager configured in the SSL context.
*
* <h2>Security Warning</h2>
* This acts like {@link TrustAllStrategy}, with the only restriction that the certificate chain
* must have length 1. This means this trust strategy does not protect against man-in-the-middle
* attacks. See the {@link TrustAllStrategy} for more information and more secure alternatives.
*
* @deprecated
* For self-signed certificates prefer specifying a keystore containing the certificate when
* calling the {@link org.apache.hc.core5.ssl.SSLContextBuilder} {@code loadTrustMaterial}
* methods.
* @since 4.1
*/
@Deprecated
@Contract(threading = ThreadingBehavior.STATELESS)
public class TrustSelfSignedStrategy implements TrustStrategy {