Preemptive auth deactivated for SSL auth as mandated by RFC8446

Robert Rodewald · Robert Rodewald · commit 46c7905a2960 · 2021-08-12T11:05:11.000+02:00
diff --git a/java/org/apache/catalina/authenticator/SSLAuthenticator.java b/java/org/apache/catalina/authenticator/SSLAuthenticator.java
@@ -20,13 +20,13 @@
 import java.security.Principal;
 import java.security.cert.X509Certificate;
 
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-
 import org.apache.catalina.Globals;
 import org.apache.catalina.connector.Request;
 import org.apache.coyote.ActionCode;
 
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
 /**
  * An <b>Authenticator</b> and <b>Valve</b> implementation of authentication
  * that utilizes SSL certificates to identify client users.
@@ -103,12 +103,6 @@ protected String getAuthMethod() {
         return HttpServletRequest.CLIENT_CERT_AUTH;
     }
 
-    @Override
-    protected boolean isPreemptiveAuthPossible(Request request) {
-        X509Certificate[] certs = getRequestCertificates(request);
-        return certs != null && certs.length > 0;
-    }
-    
     /**
      * Look for the X509 certificate chain in the Request under the key
      * <code>jakarta.servlet.request.X509Certificate</code>. If not found, trigger
