eclipse-ee4j / eclipse-ee4j/jersey
Setting default SSL socket factory overrides custom ssl configuration of existing client
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
I'm observing a weird jersey http(s) client behaviour that I believe is a bug.
It basically goes like this:
- configure client with custom ssl config
- make a request
- set default ssl socket factory
- make another request
The second request uses a wrong ssl configuration. The client seems to use the default ssl socket factory and ignores its own ssl configuration.
I believe it is a serious bug. In my real case, setting the default ssl soc. factory happens somewhere else in the app completely unrelated to the jersey client being used. As a result without changing my client in any way, it is no more able to make requests to my server.
It can also create a big security problem. If I have a client configured to trust only a specific server, by setting the default ssl soc. factory (which the client shouldn't use) I can make it trust all servers.
I case my explanation wasn't understandable, here is a simple test case:
```java
// prepare custom ssl config
SslConfigurator sslConfig = SslConfigurator.newInstance()
.trustStore(serverTrustStore)
.trustStorePassword(SERVER_TRUST_PASSWORD)
.keyStore(clientKeyStore)
.keyStorePassword(CLIENT_KEY_PASSWORD);
SSLContext sslContext = sslConfig.createSSLContext();
// create client using my ssl config
try (Client client = ClientBuilder.newBuilder()
.sslContext(sslContext)
.register(auth)
.build()) {
// make a GET request
Response response = client.target(testUrl)
.request()
.get();
//everything works - my server is trusted
assertEquals(200, response.getStatus());
// set default ssl socket factory
SSLContext sc = SSLContext.getInstance("SSL");
sc.init(null, null, null);
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
// make a GET request (using the same client configured with my custom ssl config)
// => ERROR - javax.net.ssl.SSLHandshakeException - the server is not trusted because the client used
// the wrong ssl socket factory
response = client.target(testUrl)
.request()
.get();
assertEquals(200, response.getStatus());
}
```
Contributor guide
Assessment
This issue has not been assessed yet.