eclipse-ee4j / eclipse-ee4j/jersey

Setting default SSL socket factory overrides custom ssl configuration of existing client

Open
#5,422 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

I'm observing a weird jersey http(s) client behaviour that I believe is a bug.
It basically goes like this:
- configure client with custom ssl config
- make a request
- set default ssl socket factory
- make another request

The second request uses a wrong ssl configuration. The client seems to use the default ssl socket factory and ignores its own ssl configuration.

I believe it is a serious bug. In my real case, setting the default ssl soc. factory happens somewhere else in the app completely unrelated to the jersey client being used. As a result without changing my client in any way, it is no more able to make requests to my server.

It can also create a big security problem. If I have a client configured to trust only a specific server, by setting the default ssl soc. factory (which the client shouldn't use) I can make it trust all servers.

I case my explanation wasn't understandable, here is a simple test case:

```java
// prepare custom ssl config
SslConfigurator sslConfig = SslConfigurator.newInstance()
.trustStore(serverTrustStore)
.trustStorePassword(SERVER_TRUST_PASSWORD)
.keyStore(clientKeyStore)
.keyStorePassword(CLIENT_KEY_PASSWORD);
SSLContext sslContext = sslConfig.createSSLContext();

// create client using my ssl config
try (Client client = ClientBuilder.newBuilder()
.sslContext(sslContext)
.register(auth)
.build()) {

// make a GET request
Response response = client.target(testUrl)
.request()
.get();
//everything works - my server is trusted
assertEquals(200, response.getStatus());

// set default ssl socket factory
SSLContext sc = SSLContext.getInstance("SSL");
sc.init(null, null, null);
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

// make a GET request (using the same client configured with my custom ssl config)
// => ERROR - javax.net.ssl.SSLHandshakeException - the server is not trusted because the client used
// the wrong ssl socket factory
response = client.target(testUrl)
.request()
.get();
assertEquals(200, response.getStatus());
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.