[CXF-8415] DefaultHostnameVerifier fails with HttpCore NIO

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.1
• Fix Version/s: 3.5.0, 3.4.3, 3.3.10

Environment

CXF version 3.4.1
httpcore-nio version 4.4.13
httpasyncclient version 4.1.4

• Estimated Complexity: Unknown
• Assignee: Freeman Yue Fang
• Reporter: Per-Ivar Bakke
• Created: 25/Jan/21 13:09
• Updated: 22/Dec/21 20:41
• Resolved: 28/Jan/21 16:08

Description

DefaultHostnameVerifier throws RuntimeException causing the IOReactor in HttpCore NIO to die. I have registered an issue on Apache HttpCore NIO HTTPCORE-660, but I really think this should be fixed in CXF.

Please not that the line in question was changed from returning false to throwing RuntimeException as part of CXF-7876. But, maybe a better approach would be to not catch the SSLException. This will not kill the IOReactor in HttpCore NIO.

Steps to reproduce

1. Configure CXF to use asynchronous client http transport
2. Test towards a server having a certificate with non-matching host (for instance wrong.host.badssl.com)

Issue Links

• is duplicated by: CXF-8437 DefaultHostnameVerifier accepts any certificate as valid which is a secure issue