HostnameVerifier should check certificates

Docs > Code Analysis > Static Analysis Rules > HostnameVerifier should check certificates

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: java-security/hostname-verifier-true

Language: Java

Severity: Error

Category: Security

CWE: 295

Description

A HostnameVerifier implementation should never just return true.

Learn More

HostnameVerifier that accept any signed certificates
CWE-295: Improper Certificate Validation

Non-Compliant Code Examples

public class AllHosts implements HostnameVerifier {
    public boolean verify(final String hostname, final SSLSession session) {
        return true;
    }
}

Compliant Code Examples

public class AllHosts implements HostnameVerifier {
    public boolean verify(final String hostname, final SSLSession session) {
        if(isValidCertificate) {
            return true;
        }
        return false;
    }
}