Re: Tomcat Secure WebSockets clients - hostname verification

2019-10-09 Thread Gary Sheppard
On Wed, Oct 9, 2019, 18:11 Gary Sheppard wrote: > On Tue, Jun 12, 2018 at 12:13 Mark Thomas wrote: > > >> It would be very useful to be able to configure this, so if you are > >> going to patch the code, please make this configurable by the client. > >> See HttpsURLConnection.setHostnameVerifier >

Re: Tomcat Secure WebSockets clients - hostname verification

2019-10-09 Thread Gary Sheppard
On Tue, Jun 12, 2018 at 12:13 Mark Thomas wrote: >> It would be very useful to be able to configure this, so if you are >> going to patch the code, please make this configurable by the client. >> See HttpsURLConnection.setHostnameVerifier >> >> I think it's appropriate to simply match that API unl

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-13 Thread tomcat
Thanks, Remy and Chris, for providing this clarification. On 12.06.2018 20:34, Rémy Maucherat wrote: On Tue, Jun 12, 2018 at 7:05 PM André Warnier (tomcat) wrote: This is a bit OT, but I have a question since the beginning of this thread : Is Tomcat really supposed to provide a websocket *cli

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-12 Thread Rémy Maucherat
On Tue, Jun 12, 2018 at 7:05 PM André Warnier (tomcat) wrote: > This is a bit OT, but I have a question since the beginning of this thread > : > Is Tomcat really supposed to provide a websocket *client* API ? > Yes, the client API is part of the websockets EE specification. Initially, Tomcat had

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 André, On 6/12/18 1:06 PM, André Warnier (tomcat) wrote: > On 12.06.2018 18:13, Mark Thomas wrote: [snip].. >> >> I'll see what I can do. The major constraint is that all this has >> to be set via Tomcat specific user properties as there is no API

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-12 Thread tomcat
On 12.06.2018 18:13, Mark Thomas wrote: [snip].. I'll see what I can do. The major constraint is that all this has to be set via Tomcat specific user properties as there is no API for in the Java WebSocket API. This is a bit OT, but I have a question since the beginning of this thread : Is T

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-12 Thread Mark Thomas
On 12/06/2018 16:12, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 6/11/18 10:31 AM, Mark Thomas wrote: On 11/06/18 11:47, Weiner Harald wrote: What are your thoughts? I'm leaning towards adding: SSLParameters sslParams = new SSLParameters(); sslPar

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 6/11/18 10:31 AM, Mark Thomas wrote: > On 11/06/18 11:47, Weiner Harald wrote: > > > >> What are your thoughts? > > I'm leaning towards adding: > > SSLParameters sslParams = new SSLParameters(); > sslParams.setEndpointIdentificationAl

Re: Tomcat Secure WebSockets clients - hostname verification

2018-06-11 Thread Mark Thomas
On 11/06/18 11:47, Weiner Harald wrote: > What are your thoughts? I'm leaning towards adding: SSLParameters sslParams = new SSLParameters(); sslParams.setEndpointIdentificationAlgorithm("HTTPS"); sslSocket.setSSLParameters(sslParams); unconditionally to WsWebSocketContainer.createSSLEngine()

Tomcat Secure WebSockets clients - hostname verification

2018-06-11 Thread Weiner Harald
Hello Tomcat user group, I want a Tomcat-Servlet to connect to a secure web socket endpoint to exchange data with another component / server (so my Tomcat-Servlet is acting as a WebSocket client). Now I would also like to do some hostname verification (verify that the host to which I am connect