Security context

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

src/main/java/reactor/ipc/netty/http/client/HttpClientConnect.java: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: The client repeatedly suffered from missing or bypassed hostname verification during runtime redirects or relative GET processing because endpoint identification was not applied to the underlying SSLEngine. This allowed successful connections to spoofed hosts despite requesting TLS.

Auth Bypass: Connection pooling mechanisms previously allowed connections with differing security boundaries (such as distinct SSL contexts, proxies, or protocols) to be reused across different requests because the connection pool key only accounted for the target host and socket address. This allowed unauthenticated or less-privileged flows to reuse highly-privileged tunnels.

Auth Bypass: When absolute HTTP redirects occurred on a secure HttpClient instance, the connection failed to strip existing SSL/TLS configurations. This allowed secure settings to spill into plaintext transports or unexpectedly persist across security boundaries.