<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Thanks for the updates Xuelei, some minor comments inline..<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 1 Nov 2018, at 23:42, Xuelei Fan <<a href="mailto:xuelei.fan@oracle.com" class="">xuelei.fan@oracle.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">On 11/1/2018 11:24 AM, Sean Mullan wrote:</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">On 10/31/18 11:52 AM, Chris Hegarty wrote:<br class=""><blockquote type="cite" class="">Xuelei,<br class=""><br class="">On 30/10/18 20:55, Xuelei Fan wrote:<br class=""><blockquote type="cite" class="">Hi,<br class=""><br class="">For the current HttpsURLConnection, there is not much security parameters exposed in the public APIs. An application may need richer information for the underlying TLS connections, for example the negotiated TLS protocol version.<br class=""><br class="">Please let me know if you have concerns to add a new method HttpsURLConnection.getSSLSession() and deprecate the duplicated methods, by the end of Nov. 2, 2018.<br class=""><br class="">Here is the proposal:<br class=""> <span class="Apple-converted-space"> </span><a href="https://bugs.openjdk.java.net/browse/JDK-8213161" class="">https://bugs.openjdk.java.net/browse/JDK-8213161</a><br class=""></blockquote></blockquote>Are there any security issues associated with returning the SSLSession, since it is mutable?<br class=""></blockquote><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">It should be fine. The update APIs of the session (invalidating, bind values) does not impact the connection.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""></div></blockquote><div><br class=""></div><div>Alternatively, as is done in the new HTTP Client, an immutable</div><div>SSLSession instance can be returned.</div><br class=""><blockquote type="cite" class=""><div class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">+ * SHOULD override this method with appropriate implementation.<br class="">s/appropriate/an appropriate/<br class="">I would probably not capitalize "SHOULD" and just say "should". "SHOULD" is more common in RFCs. I don't see that much in javadocs.<br class="">+ * @implNote The JDK Reference Implementation supports this operation.<br class="">+ * As an application may have to use this operation for more<br class="">+ * security parameters, it is recommended to support this<br class="">+ * operation in all implementations.<br class="">I think it should be obvious that the JDK implementation would override this method so not sure that first sentence is necessary. The other sentence seems like it could be combined with the previous sentence, ex:<br class="">"Subclasses should override this method with an appropriate implementation since an application may need to access additional parameters associated with the SSL session."<br class=""></blockquote><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Updated accordingly, in the CSR and webrev:</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class=""> </span><a href="https://bugs.openjdk.java.net/browse/JDK-8213161" class="">https://bugs.openjdk.java.net/browse/JDK-8213161</a></div></blockquote><br class=""></div><div>The CSR looks good. I made a few minor edits to the verbiage</div><div>and added myself as reviewer.</div><br class=""><div class="">The title will need to be updated to reflect the addition of the</div><div class="">new method in SecureCacheResponse. Maybe:</div><span class=""><br class=""></span><span class="">"Add</span> SSLSession accessors to HttpsURLConnection and<div class="">SecureCacheResponse"<span class=""><br class=""></span><span class=""><br class=""></span><span class="">-Chris.<br class=""></span><span class=""><br class=""></span><div class=""><br class=""></div><div class=""><br class=""></div></div></body></html>