jetty.project
jetty.project copied to clipboard
Change default value for `SslContextFactory.renegotiationAllowed` to `false`
Jetty version(s) 12.0.x
Description TLS renegotiation is the feature that allows (typically clients) to issue a TLS handshake in the middle of an already established secure communication.
This feature has proven to be vulnerable, and RFC 5746 fixes this vulnerability for TLS versions <= 1.2.
In TLS 1.3, the renegotiation feature has been removed.
We should change the default to false.