Perform hostname checking on :authority before issuing call

[ejona86]

We allow users to override the authority per-call, but we currently don't do any verification that that authority would be permitted for the current server. We should verify the provided authority against the TLS cert of the connection and fail in some way if the cert is not good for the requested authority. We would cache these verifications for the connection in a simple hash map.

It is the Java equivalent of https://github.com/grpc/grpc/pull/471

[carl-mastrangelo]

We need to decide if CallOptions.withAuthority will be Experimental

[ejona86]

It would have been nice for 1.0, but being realistic it won't happen by then.

[carl-mastrangelo]

Does this still need to happen for 1.1?

[larry-safran]

There are some internal users that use this. Mostly used in tests by the prod team.

[panchenko]

Currently authority-based routing in nginx works with any identifier (not a domain name) passed as authority. That would stop working if this issue is eventually implemented, am I correct?

[ejona86]

If you use TLS and the authority is not covered by the TLS certificate, yes, that would not work.