IS-167 Hostname verification disabled

swedenconnect · Oct 26, 2023 · c4be72d · c4be72d
1 parent daf1399
commit c4be72d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/...in/java/se/swedenconnect/signservice/authn/saml/config/MetadataProviderConfiguration.java b/...in/java/se/swedenconnect/signservice/authn/saml/config/MetadataProviderConfiguration.java
@@ -30,7 +30,7 @@
 
 import org.apache.commons.lang3.StringUtils;
 import org.apache.hc.client5.http.classic.HttpClient;
-import org.apache.hc.client5.http.ssl.DefaultHostnameVerifier;
+import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
 
 import jakarta.annotation.Nonnull;
 import jakarta.annotation.Nullable;
@@ -206,7 +206,7 @@ else if (StringUtils.isNotBlank(this.file)) {
   protected HttpClient createHttpClient() {
     try {
       final List<TrustManager> managers = Arrays.asList(HttpClientSupport.buildNoTrustX509TrustManager());
-      final HostnameVerifier hnv = new DefaultHostnameVerifier();
+      final HostnameVerifier hnv = new NoopHostnameVerifier();
 
       HttpClientBuilder builder = new HttpClientBuilder();
       builder.setUseSystemProperties(true);