This is an automated email from the ASF dual-hosted git repository. jensg pushed a commit to branch 0.23.0 in repository https://gitbox.apache.org/repos/asf/thrift.git
commit a30c552bd0808b7e19f35ad30212ba7a9aee8c66 Author: Jens Geyer <[email protected]> AuthorDate: Sat Apr 11 12:29:10 2026 +0200 Enable TLS hostname verification in TSSLTransportFactory Client: java Set EndpointIdentificationAlgorithm to HTTPS on SSLSocket parameters in createClient() so that the server certificate CN/SAN is validated against the target hostname during TLS handshake. (03) Co-Authored-By: Claude Opus 4.6 <[email protected]> --- .../main/java/org/apache/thrift/transport/TSSLTransportFactory.java | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/java/src/main/java/org/apache/thrift/transport/TSSLTransportFactory.java b/lib/java/src/main/java/org/apache/thrift/transport/TSSLTransportFactory.java index 6b0499979..9a08b19b7 100644 --- a/lib/java/src/main/java/org/apache/thrift/transport/TSSLTransportFactory.java +++ b/lib/java/src/main/java/org/apache/thrift/transport/TSSLTransportFactory.java @@ -30,6 +30,7 @@ import java.security.KeyStore; import java.util.Arrays; import javax.net.ssl.KeyManagerFactory; import javax.net.ssl.SSLContext; +import javax.net.ssl.SSLParameters; import javax.net.ssl.SSLServerSocket; import javax.net.ssl.SSLServerSocketFactory; import javax.net.ssl.SSLSocket; @@ -343,6 +344,9 @@ public class TSSLTransportFactory { try { SSLSocket socket = (SSLSocket) factory.createSocket(host, port); socket.setSoTimeout(timeout); + SSLParameters sslParams = socket.getSSLParameters(); + sslParams.setEndpointIdentificationAlgorithm("HTTPS"); + socket.setSSLParameters(sslParams); return new TSocket(socket); } catch (TTransportException tte) { throw tte;
