RFR: 8373677: Clear text HttpServer connection could fail fast if receiving SSL ClientHello [v4]

Daniel Fuchs dfuchs at openjdk.org
Wed Dec 17 11:51:04 UTC 2025


> The first byte of a SSL ClientHello handshake record is 0x16 (22).
> If the first byte received on a HTTP/1.1 clear connection is 0x16, the HTTP server could fail fast, return 400 bad request and immediately close the connection.
> 
> This changeset extends the fail fast behaviour for other ineligible bytes, such as any byte corresponding to ASCII characters <= 31.

Daniel Fuchs has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains 10 additional commits since the last revision:

 - .toString() is not needed
 - Review feedback: improved logging
 - Merge branch 'master' into ClearTextSSL-8373677
 - Update test/jdk/com/sun/net/httpserver/ClearTextServerSSL.java
   
   Co-authored-by: Andrey Turbanov <turbanoff at gmail.com>
 - Update src/jdk.httpserver/share/classes/sun/net/httpserver/Request.java
   
   Co-authored-by: Andrey Turbanov <turbanoff at gmail.com>
 - minor test fix - unused import + obsolete comment
 - fix whitespace
 - fix copyright year in test
 - add bug id to test
 - 8373677: Clear text HttpServer connection could fail fast if receiving SSL ClientHello

-------------

Changes:
  - all: https://git.openjdk.org/jdk/pull/28827/files
  - new: https://git.openjdk.org/jdk/pull/28827/files/05704ead..2fe11cf3

Webrevs:
 - full: https://webrevs.openjdk.org/?repo=jdk&pr=28827&range=03
 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=28827&range=02-03

  Stats: 6547 lines in 291 files changed: 4362 ins; 617 del; 1568 mod
  Patch: https://git.openjdk.org/jdk/pull/28827.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/28827/head:pull/28827

PR: https://git.openjdk.org/jdk/pull/28827


More information about the net-dev mailing list