HostnameVerifier should check certificates

Docs > Code Analysis > Static Analysis Rules > HostnameVerifier should check certificates

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: java-security/hostname-verifier-true

Language: Java

Severity: Error

Category: Security

CWE: 295

Description

A HostnameVerifier implementation should never just return true.

Learn More

HostnameVerifier that accept any signed certificates
CWE-295: Improper Certificate Validation

Non-Compliant Code Examples

public class AllHosts implements HostnameVerifier {
    public boolean verify(final String hostname, final SSLSession session) {
        return true;
    }
}

Compliant Code Examples

public class AllHosts implements HostnameVerifier {
    public boolean verify(final String hostname, final SSLSession session) {
        if(isValidCertificate) {
            return true;
        }
        return false;
    }
}