-
Notifications
You must be signed in to change notification settings - Fork 115
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Proposal: Deprecate the ClientBuilder.hostnameVerifier method #1161
Comments
I am -1 on this one. First, even if this is not supported by the java.net.http.HttpClient, it does not mean it is not supported by other clients (HttpsUrlConnection, Apache, ...)
Jersey does not use it with HttpClient. But I am ok to update the Javadoc informing about the limited use. |
I completely understand and respect the argument. There are ways around this for sure so it's not a huge deal, but just in case others wanted to start using the JDK's |
@jamezp Should we close this one then? |
@spericas We can if no one else agrees they want it deprecated :) |
Closing this as it's not agreed upon which is fine. |
I propose we should deprecate the
ClientBuilder.hostnameVerifier()
. The JDK HttpClient does not have a way to set this. It does allow this to be disabled, but it's a global setting which doesn't work well for the ClientBuilder. It could also be overridden with some custom HostnameVerifier, however that seems it could lead to security risks.There is an open issue, DK-8213309, to enable this. However, there has been no word from the JDK team to indicate they will add this.
My assumption is this override was added for testing or internal use cases. It seems like something that could be worked around in different ways or a safer manner.
The text was updated successfully, but these errors were encountered: