dxbjavid opened a new pull request, #902: URL: https://github.com/apache/httpcomponents-client/pull/902
SpkiPinningClientTlsStrategy matches pin rules against the host exactly as given, so a request to https://api.example.com./ yields api.example.com. and no rule applies, while the default built-in hostname check still accepts it because the JDK drops the root dot from SNI. In practice any CA-trusted certificate for a pinned host appears to be accepted whenever the URL is spelt in its absolute form (for instance after a redirect), which rather defeats the pinning; against a local TLS server with a non-matching pin the plain host is rejected while the dotted one returns 200. The patch strips a single trailing dot from both the request host and the configured patterns before matching, with a regression test covering the exact and wildcard cases. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
