raboof/pekko
1
0
Fork 0
Code Issues Pull requests Projects Releases 6 Packages Wiki Activity Actions 10

Merge pull request #18062 from spray/w/15687-enable-endpoint-verification

Browse source 
#18059 #15687 Enable https hostname verification
This commit is contained in:
Konrad Malawski 2015-08-03 11:35:37 +02:00
commit d89b9e19b1
17 changed files with 440 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

16
akka-docs-dev/rst/scala/http/client-side/https-support.rst
View file

@ -36,5 +36,21 @@ Afterwards you simply use ``outgoingConnectionTls``, ``newHostConnectionPoolTls`
``superPool`` or ``singleRequest`` without a specific ``httpsContext`` argument, which causes encrypted connections
to rely on the configured default client-side ``HttpsContext``.
If no custom ``HttpsContext`` is defined the default context uses Java's default TLS settings. Customizing the
``HttpsContext`` can make the Https client less secure. Understand what you are doing!
Hostname verification on Java 6
-------------------------------
Hostname verification proves that the Akka HTTP client is actually communicating with the server it intended to
communicate with. Without this check a man-in-the-middle attack is possible. In the attack scenario, an alternative
certificate would be presented which was issued for another host name. Checking the host name in the certificate
against the host name the connection was opened against is therefore vital.
The default ``HttpsContext`` enables hostname verification. Akka HTTP relies on a Java 7 feature to implement
the verification. To prevent an unintended security downgrade, accessing the default ``HttpsContext`` on Java 6
will fail with an exception. Specifying a custom ``HttpsContext`` or customizing the default one is also possible
on Java 6.
.. _akka.http.scaladsl.Http: @github@/akka-http-core/src/main/scala/akka/http/scaladsl/Http.scala