CODEWITHSUNDEEP
javasecuritysslserverjsse
gregw
gregw

Reputation: 2414

How to disable SSL Session Cache server side java?

Is there a way to disable the server side session cache when using the JVM's SSLEngine? Because the size and timeout setter treat 0 as no-limite, the best I can do is to reduce the cache size to 1 and it's timeout to 1s, but I can't see how to disable it entirely.

I can see client side how to not offer host details, so as to not offer caching, but that is not what I'm after.

Upvotes: 4

Views: 1964

Answers (1)

Sovietaced
Sovietaced

Reputation: 141

The only way that I am aware to do this is to invalidate the session yourself. 

private void invalidateSocketSSLSession(Socket s) {
    if (s != null && s instanceof SSLSocket) {
        SSLSocket sock = (SSLSocket) s;
        if (sock.getSession() != null) {
            sock.getSession().invalidate();
        }
    }
}

Upvotes: 0

Related Questions