Instances from the class javax.net.ssl.SSLSocket should be created instead of normal Sockets when transferring objects over communication channels. SSLSockets provide a layer of security protocols such as SSL or TLS.Ware]

The principal protections included in SSLSockets that are not provided by the Socket class are: Java API]

This example shows the use of regular sockets for a server application that does not protect sensitive information in transit. Te insecure code for the corresponding client application follows the server's code.

Code Block

bgColor	#FFCCCC

import java.net.ServerSocket;
import java.net.Socket;
import java.io.*; 

public class EchoServer { 
  public static void main(String[] args) { 
    try { 
      ServerSocket serverSocket = new ServerSocket(10007); 
      Socket socket = serverSocket.accept();
			
      PrintWriter out = new PrintWriter( socket.getOutputStream(),true); 
      BufferedReader in = new BufferedReader(new InputStreamReader( socket.getInputStream())); 

      String inputLine; 

      while ((inputLine = in.readLine()) != null) { 
        System.out.println (inputLine); 
        out.println(inputLine); 
      } 

      out.close(); 
      in.close(); 
      socket.close();  
    }
    catch (Exception e) { 
      /*Handle exception*/
    }   
  }
}

Compliant solution

This compliant solution makes use of SSLSockets to protect packets using the SSL and TLS security protocols.

Code Block

bgColor	#CCCCFF

{code:bgColor=#FFCCCC}
import javaxjava.netio.ssl.SSLServerSocket*;
import javaxjava.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import java.io.*;

public class EchoServerEchoClient {
  public static void main(String[] args) {
    try {
      SSLServerSocketFactorySocket sslserversocketfactorysocket = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
      SSLServerSocket sslserversocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(9999);
      SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();

new Socket("localhost", 9999);
						
      PrintWriter out = new PrintWriter( sslsocketsocket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(new InputStreamReader( sslsocketsocket.getInputStream()));

      BufferedReader stdIn = new   BufferedReader(new InputStreamReader(System.in));
			
      String inputLineuserInput; 
            
      while ((inputLineuserInput = instdIn.readLine()) != null) { 
        System.out.println (inputLineuserInput); 
	System.out.println(inputLinein.readLine()); 
      } 
			
      out.close(); 
      in.close();
      stdIn.close();
      sslsocketsocket.close(); 
    } 
    catch (Exception e) { 
      /*Handle exception*/
    } 
  }
}

Noncompliant code example

Compliant solution

This compliant solution makes use of SSLSockets to protect packets using the SSL and TLS security protocolsThis is the insecure code for the corresponding client application.

Code Block

bgColor	#FFCCCC#CCCCFF

import java.io.*javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import java.netio.*;

public class EchoClientEchoServer {
  public static void main(String[] args) {
    try {
      SocketSSLServerSocketFactory socketsslserversocketfactory = new Socket("localhost", 9999);
						(SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
      SSLServerSocket sslserversocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(9999);
      SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();

      PrintWriter out = new PrintWriter(socket sslsocket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(new InputStreamReader(socket sslsocket.getInputStream()));

       BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
			
      String userInputinputLine; 
            
      while ((userInputinputLine = stdInin.readLine()) != null) { 
        System.out.println (userInputinputLine); 
	System.out.println(in.readLine()inputLine); 
      } 
			
      out.close(); 
      in.close(); 
      stdInsslsocket.close();
      socket.close();
    } 
    catch (Exception e) { 
      /*Handle exception*/
    } 
  }
}