RFR: 8373677: Clear text HttpServer connection could fail fast if receiving SSL ClientHello [v4]
Daniel Fuchs
dfuchs at openjdk.org
Wed Dec 17 11:51:04 UTC 2025
> The first byte of a SSL ClientHello handshake record is 0x16 (22).
> If the first byte received on a HTTP/1.1 clear connection is 0x16, the HTTP server could fail fast, return 400 bad request and immediately close the connection.
>
> This changeset extends the fail fast behaviour for other ineligible bytes, such as any byte corresponding to ASCII characters <= 31.
Daniel Fuchs has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains 10 additional commits since the last revision:
- .toString() is not needed
- Review feedback: improved logging
- Merge branch 'master' into ClearTextSSL-8373677
- Update test/jdk/com/sun/net/httpserver/ClearTextServerSSL.java
Co-authored-by: Andrey Turbanov <turbanoff at gmail.com>
- Update src/jdk.httpserver/share/classes/sun/net/httpserver/Request.java
Co-authored-by: Andrey Turbanov <turbanoff at gmail.com>
- minor test fix - unused import + obsolete comment
- fix whitespace
- fix copyright year in test
- add bug id to test
- 8373677: Clear text HttpServer connection could fail fast if receiving SSL ClientHello
-------------
Changes:
- all: https://git.openjdk.org/jdk/pull/28827/files
- new: https://git.openjdk.org/jdk/pull/28827/files/05704ead..2fe11cf3
Webrevs:
- full: https://webrevs.openjdk.org/?repo=jdk&pr=28827&range=03
- incr: https://webrevs.openjdk.org/?repo=jdk&pr=28827&range=02-03
Stats: 6547 lines in 291 files changed: 4362 ins; 617 del; 1568 mod
Patch: https://git.openjdk.org/jdk/pull/28827.diff
Fetch: git fetch https://git.openjdk.org/jdk.git pull/28827/head:pull/28827
PR: https://git.openjdk.org/jdk/pull/28827
More information about the net-dev
mailing list