Re: Can an upate center be on a site that requires https?

Yes, the update ui works with https and/or basic authentication, either
with the NbAuthenticator (user dialog) every time the update center is
called, or you have to include username & password in the update center
url.
But still, security could be improved and made more configurable. I'd
really appreciate all or one of the following:
1. Store username / password at a secure place (use the Netbeans Keyring
API for example)
2. Controll initialization of the SSLContext. Why? If you provide
customized modules for individual users of your application, with
additional functionality and/or possibly sensitive data, via individual
update centers - which is very convenient for support -, I'd like to use
ssl mutual authentication for updates, meaning that the client needs a
valid certificate, which the update center server accepts, to get access to
update content.
All code related to ssl initialization is contained in one class in
 (org.netbeans.modules.autoupdate.updateprovider.NetworkAccess.initSSL()),
so it should be easy to make it configurable, e.g. by introducing something
like an optional "UpdateCenterSecurityConfiguration" callback service
class.
Boris

2015-12-01 17:46 GMT+01:00 Birdasaur <[email protected]>:

> I can confirm this with my own findings.
> I was able to serve out an Update Center using an HTTPS Subversion
> repository even.  This was super convenient because the platform will
> automatically popup a username/password dialog when attempting to connect
> to such an Update center.
>
> I love the platform.    :D
>
>
>
>
>