Uploaded image for project: 'WildFly Elytron'
  1. WildFly Elytron
  2. ELY-1009

Default settings of SSL session caching for Elytron *-ssl-context are not safe

XMLWordPrintable

      The default values of maximum-session-cache-size and session-timeout of Elytron *-ssl-context are 0. This is not safe because SSL sessions can be stored indefinitely. Furthermore, such default settings overwrites default settings in Java, which can be unexpected.

      There should be reasonable combination of values, or Java default values should be (let) used.

      For example, see http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/8u40-b25/sun/security/ssl/SSLSessionContextImpl.java

            rhn-support-ivassile Ilia Vassilev
            rhn-support-ivassile Ilia Vassilev
            Ondrej Kotek Ondrej Kotek
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: