Change default value for SslContextFactory.renegotiationAllowed to false #12378
Description
Jetty version(s)
12.0.x
Description
TLS renegotiation is the feature that allows (typically clients) to issue a TLS handshake in the middle of an already established secure communication.
This feature has proven to be vulnerable, and RFC 5746 fixes this vulnerability for TLS versions <= 1.2.
In TLS 1.3, the renegotiation feature has been removed.
We should change the default to false.