gRPC Java 1.85

Last reviewed Oct 25, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 25113 lines · 2.8K tokens
  2. gRPC Java 1.8556 lines · 3.3K tokens
Total169 lines · 6.2K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 113
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 295
  • 297
  • 306
  • 319
  • 323
  • 327
  • 338
  • 347
  • 362
  • 367
  • 378
  • 427
  • 470
  • 471
  • 488
  • 494
  • 502
  • 532
  • 611
  • 653
  • 681
  • 732
  • 770
  • 772
  • 776
  • 789
  • 807
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333

Prompt Preview

Apply these rules to gRPC Java 1.85 clients and services on the included Java 25 baseline. Treat RPC messages, metadata, resolver results, and control-plane configuration as separate trust boundaries.

Transport and peer identity

  • Build network channels and servers with Grpc.newChannelBuilder / Grpc.newServerBuilderForPort and explicit TlsChannelCredentials / TlsServerCredentials. The one-argument NettyServerBuilder.forPort(int) creates a plaintext listener; use its ServerCredentials overload for a TLS boundary. Keep InsecureChannelCredentials, InsecureServerCredentials, and usePlaintext() confined to deliberately protected local or externally secured hops; never send bearer credentials over an exposed plaintext connection.
  • For mutual TLS, configure trusted client roots and TlsServerCredentials.Builder.clientAuth(ClientAuth.REQUIRE); OPTIONAL does not require a certificate. Read the peer certificate identity from ServerCall.getAttributes().get(Grpc.TRANSPORT_ATTR_SSL_SESSION) when the transport terminates TLS locally; fail closed if the required session or verified peer is absent. Map that identity to an application principal and authorize the requested resource separately.
  • Keep HTTPS endpoint identification enabled in custom Netty TLS contexts, and use GrpcSslContexts to configure HTTP/2 TLS. Pass endpointIdentificationAlgorithm("") only for a peer whose identity is not a DNS name, and only together with a trust manager or handshake check that verifies that identity instead; never use the empty value just to get past a hostname