jetty.project icon indicating copy to clipboard operation
jetty.project copied to clipboard

Change default value for `SslContextFactory.renegotiationAllowed` to `false`

Open sbordet opened this issue 1 year ago • 0 comments

Jetty version(s) 12.0.x

Description TLS renegotiation is the feature that allows (typically clients) to issue a TLS handshake in the middle of an already established secure communication.

This feature has proven to be vulnerable, and RFC 5746 fixes this vulnerability for TLS versions <= 1.2.

In TLS 1.3, the renegotiation feature has been removed.

We should change the default to false.

sbordet avatar Oct 11 '24 17:10 sbordet