Server to reject client-initiated ssl renegotiation
@@ -40,13 +40,15 @@ public class ServerUtils {
HttpConfiguration https = new HttpConfiguration();
https.addCustomizer(new SecureRequestCustomizer());
- SSLContext sslContext = ServerSSLContextFactory.create()
- .from(uri.toString(), serverConfig.getSslConfig());
+ SSLContext sslContext = ServerSSLContextFactory.create().from(uri.toString(), serverConfig.getSslConfig());
SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
sslContextFactory.setSslContext(sslContext);
sslContextFactory.setNeedClientAuth(true);
- ServerConnector connector = new ServerConnector(server,
+ sslContextFactory.setRenegotiationAllowed(false);
+ ServerConnector connector =
+ new ServerConnector(
+ server,
new SslConnectionFactory(sslContextFactory, "http/1.1"),
new HttpConnectionFactory(https));
connector.setPort(uri.getPort());
