On 11/1/2018 11:24 AM, Sean Mullan wrote:
On 10/31/18 11:52 AM, Chris Hegarty wrote:
Xuelei,
On 30/10/18 20:55, Xuelei Fan wrote:
Hi,
For the current HttpsURLConnection, there is not much security
parameters exposed in the public APIs. An application may need
richer information for the underlying TLS connections, for example
the negotiated TLS protocol version.
Please let me know if you have concerns to add a new method
HttpsURLConnection.getSSLSession() and deprecate the duplicated
methods, by the end of Nov. 2, 2018.
Here is the proposal:
https://bugs.openjdk.java.net/browse/JDK-8213161
Are there any security issues associated with returning the SSLSession,
since it is mutable?
It should be fine. The update APIs of the session (invalidating, bind
values) does not impact the connection.
+ * SHOULD override this method with appropriate
implementation.
s/appropriate/an appropriate/
I would probably not capitalize "SHOULD" and just say "should". "SHOULD"
is more common in RFCs. I don't see that much in javadocs.
+ * @implNote The JDK Reference Implementation supports this operation.
+ * As an application may have to use this operation for more
+ * security parameters, it is recommended to support this
+ * operation in all implementations.
I think it should be obvious that the JDK implementation would override
this method so not sure that first sentence is necessary. The other
sentence seems like it could be combined with the previous sentence, ex:
"Subclasses should override this method with an appropriate
implementation since an application may need to access additional
parameters associated with the SSL session."
Updated accordingly, in the CSR and webrev:
https://bugs.openjdk.java.net/browse/JDK-8213161
http://cr.openjdk.java.net/~xuelei/8212261/webrev.02/
Thanks,
Xuelei
