Zakaria El OrcheandClaude Sonnet 5
1b48d14b4f
- TlsConfig.applicationProtocols(String...) sets the listener's negotiable ALPN protocol list via SSLParameters, inherited by every accepted socket like clientAuth — works on both keystore() and ofContext(), untouched unless called. Enables TLS-ALPN-01 (RFC 8737) style on-demand cert issuance: a custom KeyManager can read the already-resolved protocol via engine/socket getHandshakeApplicationProtocol() inside chooseEngineServerAlias/chooseServerAlias, since ALPN is resolved during ClientHello/ServerHello, always before Certificate production. - Request gains isSecure()/sslSession(), threaded through RequestParser from the accepted SSLSocket exactly like remoteAddress() — reference-only, zero per-request allocation. sslSession() defers to SSLSocket#getSession() lazily, so it's a cached-field read (handshake already completed by the time a handler can call it), never a forced handshake. - WebSocketSession.isSecure()/sslSession() delegate to the upgrading Request rather than tracking the socket a second time. - Documents TLS end-to-end in README.md (listeners, TlsConfig, SNI, ALPN, mTLS, Request/WebSocketSession accessors). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>