Wiki Markup javax.net.ssl.SSLSocket}} should be created instead of normal Sockets when transferring objects over communication channels. {{SSLSockets}} provide a layer of security protocols such as SSL or TLS.Wiki Markup
The principal protections included in SSLSockets that are not provided by the Socket class are: Java API]According to \[[Java API|AA. Java References#API 06]\] , the principal protections included in {{SSLSockets}} that are not provided by the {{Socket}} class are:
- Integrity Protection. SSL protects against modification of messages by an active wiretapper.
- Authentication. In most modes, SSL provides peer authentication. Servers are usually authenticated, and clients may be authenticated as requested by servers.
- Confidentiality (Privacy Protection). In most modes, SSL encrypts data being sent between client and server. This protects the confidentiality of data, so that passive wiretappers won't see sensitive data such as financial information or personal information of many kinds.
Noncompliant
...
Code Example
This example shows the use of regular Sockets sockets for a server application . Using this kind of Sockets that does not protect sensitive information while being in transit.
| Code Block | ||
|---|---|---|
| ||
import java.net.ServerSocket;
import java.net.Socket;
import java.io.*;
public class EchoServer {
public static void main(String[] args) {
try {
ServerSocket serverSocket = new ServerSocket(10007);
Socket socket = serverSocket.accept();
PrintWriter out = new PrintWriter( socket.getOutputStream(),true);
BufferedReader in = new BufferedReader(new InputStreamReader( socket.getInputStream()));
String inputLine;
while ((inputLine = in.readLine()) != null) {
System.out.println (inputLine);
out.println(inputLine);
}
out.close();
in.close();
socket.close();
}
catch (Exception e) {
/*Handle exception*/
}
}
}
|
Compliant solution
This is a better solution to the previous example, making ?? solution makes use of SSLSockets. By doing so, packets are protected with to protect packets using the SSL and TLS security protocols.
| Code Block | ||
|---|---|---|
| ||
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import java.io.*;
public class EchoServer {
public static void main(String[] args) {
try {
SSLServerSocketFactory sslserversocketfactory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
SSLServerSocket sslserversocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(9999);
SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();
PrintWriter out = new PrintWriter( sslsocket.getOutputStream(),true);
BufferedReader in = new BufferedReader(new InputStreamReader( sslsocket.getInputStream()));
String inputLine;
while ((inputLine = in.readLine()) != null) {
System.out.println (inputLine);
out.println(inputLine);
}
out.close();
in.close();
sslsocket.close();
}
catch (Exception e) {
/*Handle exception*/
}
}
}
|
Noncompliant code example
This is a similar insecure code for the client application.
...