Relism/Flash5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(core): ALPN configuration and TLS visibility on Request/WebSocketSession #4

Merged
Relism merged 1 commits from feature/core/tls-alpn into master 2026-08-09 23:38:27 +00:00
Conversation 0 Commits 1 Files Changed 7
+468 -27
Relism commented 2026-08-09 23:38:05 +00:00
Owner
Copy Link
Copy Source
  • TlsConfig.applicationProtocols(String...) sets the listener's negotiable
    ALPN protocol list via SSLParameters, inherited by every accepted socket
    like clientAuth — works on both keystore() and ofContext(), untouched
    unless called. Enables TLS-ALPN-01 (RFC 8737) style on-demand cert
    issuance: a custom KeyManager can read the already-resolved protocol via
    engine/socket getHandshakeApplicationProtocol() inside
    chooseEngineServerAlias/chooseServerAlias, since ALPN is resolved during
    ClientHello/ServerHello, always before Certificate production.
  • Request gains isSecure()/sslSession(), threaded through RequestParser from
    the accepted SSLSocket exactly like remoteAddress() — reference-only,
    zero per-request allocation. sslSession() defers to SSLSocket#getSession()
    lazily, so it's a cached-field read (handshake already completed by the
    time a handler can call it), never a forced handshake.
  • WebSocketSession.isSecure()/sslSession() delegate to the upgrading
    Request rather than tracking the socket a second time.
  • Documents TLS end-to-end in README.md (listeners, TlsConfig, SNI, ALPN,
    mTLS, Request/WebSocketSession accessors).

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

- TlsConfig.applicationProtocols(String...) sets the listener's negotiable ALPN protocol list via SSLParameters, inherited by every accepted socket like clientAuth — works on both keystore() and ofContext(), untouched unless called. Enables TLS-ALPN-01 (RFC 8737) style on-demand cert issuance: a custom KeyManager can read the already-resolved protocol via engine/socket getHandshakeApplicationProtocol() inside chooseEngineServerAlias/chooseServerAlias, since ALPN is resolved during ClientHello/ServerHello, always before Certificate production. - Request gains isSecure()/sslSession(), threaded through RequestParser from the accepted SSLSocket exactly like remoteAddress() — reference-only, zero per-request allocation. sslSession() defers to SSLSocket#getSession() lazily, so it's a cached-field read (handshake already completed by the time a handler can call it), never a forced handshake. - WebSocketSession.isSecure()/sslSession() delegate to the upgrading Request rather than tracking the socket a second time. - Documents TLS end-to-end in README.md (listeners, TlsConfig, SNI, ALPN, mTLS, Request/WebSocketSession accessors). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Relism added 1 commit 2026-08-09 23:38:05 +00:00
feat(core): ALPN configuration and TLS visibility on Request/WebSocketSession
CI / Build & Test (push) Failing after 5m3s
Details
CI / Build & Test (pull_request) Failing after 4m53s
Details
1b48d14b4f 
- TlsConfig.applicationProtocols(String...) sets the listener's negotiable
  ALPN protocol list via SSLParameters, inherited by every accepted socket
  like clientAuth — works on both keystore() and ofContext(), untouched
  unless called. Enables TLS-ALPN-01 (RFC 8737) style on-demand cert
  issuance: a custom KeyManager can read the already-resolved protocol via
  engine/socket getHandshakeApplicationProtocol() inside
  chooseEngineServerAlias/chooseServerAlias, since ALPN is resolved during
  ClientHello/ServerHello, always before Certificate production.
- Request gains isSecure()/sslSession(), threaded through RequestParser from
  the accepted SSLSocket exactly like remoteAddress() — reference-only,
  zero per-request allocation. sslSession() defers to SSLSocket#getSession()
  lazily, so it's a cached-field read (handshake already completed by the
  time a handler can call it), never a forced handshake.
- WebSocketSession.isSecure()/sslSession() delegate to the upgrading
  Request rather than tracking the socket a second time.
- Documents TLS end-to-end in README.md (listeners, TlsConfig, SNI, ALPN,
  mTLS, Request/WebSocketSession accessors).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Relism merged commit 391ae6778e into master 2026-08-09 23:38:27 +00:00
Relism deleted branch feature/core/tls-alpn 2026-08-09 23:38:27 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Relism (Zakaria El Orche)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Relism/Flash5#4