<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Thanks for the detailed information. I have a better sense of the scenarios now. What about HTTP/2? Will the business logic or scenarios get changed for HTTP/2? Could the change apply to HTTP/1.1 as well?
<div class=""><br class="">
</div>
<div class="">Xuelei<br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On Mar 5, 2021, at 5:43 AM, arjan tijms <<a href="mailto:arjan.tijms@gmail.com" class="">arjan.tijms@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">
<div dir="ltr" class="">
<div dir="ltr" class="">Hi,
<div class=""><br class="">
</div>
</div>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Fri, Mar 5, 2021 at 2:05 AM Xue-Lei Fan <<a href="mailto:xuelei.fan@oracle.com" class="">xuelei.fan@oracle.com</a>> wrote:<br class="">
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">
<div dir="ltr" class="">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;" class="">
Does it mean that when switch to HTTP/2, the concern is not valid any longer? Or there is an alternative solution? Sorry for the questions, I know little about servlet. I'm trying to understand the requirement of this feature.</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">Mark Thomas (Tomcat maintainer) recently explained this on the Servlet mailing list. I think it explains the requirement quite well, so I'll copy/paste it:</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">"The sequence of events in the test is as follows:</div>
<div class=""><br class="">
</div>
<div class="">- Client connects.</div>
<div class="">- TLS handshake, no client authentication.</div>
<div class="">- Client sends request</div>
<div class="">- Server parses it and maps it to a web application</div>
<div class="">- Server compares request to security constraints</div>
<div class="">- Security constraints require CLIENT-CERT</div>
<div class="">- Request fails because server cannot trigger post-handshake</div>
<div class=""> authentication</div>
<div class=""><br class="">
</div>
<div class="">(Even if the server did support PHA, the client doesn't so it will fail </div>
<div class="">there instead).</div>
<div class=""><br class="">
</div>
<div class="">My reading of the spec is that the ability to create per URL security </div>
<div class="">constraints strongly implies that renegotiation / PHA needs to be </div>
<div class="">supported. The existence of this test supports that view."</div>
</div>
<div class=""><br class="">
</div>
<div class="">The above is for HTTP/1.1, which is an important supported target of Servlet. Hope the above helps.</div>
<div class=""><br class="">
</div>
<div class="">Kind regards,</div>
<div class="">Arjan Tijms </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>