Configuring Monitor for SSL does not disable non-SSL connections
- Dominant language
- Java
- Stars
- 1.2k
- Forks
- 487
- Avg merge
- 4d 5h
- Merged PRs (30d)
- 13
Description
If the monitor is configured for SSL/TLS (https), is the intention for non-SSL (http) connections to also be allowed? Looking at EmbeddedWebServer, that appears to be what is happening. It looks like this [change](https://github.com/apache/accumulo/commit/7bb91ede4804ce72b7dbf295588bdfa130599e0c#diff-3f45dc66d2fbab477712887fdc887b44b1e6484eb4fbaa9bb6e96576f7e03c03) was made in 2.0 and closed a ticket having to do with MonitorSslIT failing.
Contributor guide
Research direction
Start by reading EmbeddedWebServer and the MonitorSslIT test, then review commit 7bb91ede4804ce72b7dbf295588bdfa130599e0c to understand the current SSL configuration behavior. Confirm the intended policy for HTTP when HTTPS is configured and make the test and implementation agree; done means the monitor’s accepted connections match that policy.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100