:bangbang: <https://stackoverflow.com/questions/75258555/ktor-reusing-clients-marks-ssl-as-ok>

# ktor

[Sam]

‼️ https://stackoverflow.com/questions/75258555/ktor-reusing-clients-marks-ssl-as-ok

[Sam]

tl;dr:

suspend fun main() {
    val client = HttpClient(Java)
    val response1 = client.get("<https://sha256.badssl.com/>")
    println(response1.status)
    val response2 = client.get("<https://untrusted-root.badssl.com/>")
    println(response2.status)
}

prints

200 OK
200 OK

😬
Even though the second URL doesn’t have a valid certificate.

[Sam]

It works as expected (i.e. first request succeeds; second request fails) with the Apache engine. It also works as expected when using a freshly-created HttpClient for each request (as mentioned in the StackOverflow post)

[e5l]

Hey @Sam, could you log an issue? I will take a look

[Sam]

Will do 👍

[Sam]

I created https://youtrack.jetbrains.com/issue/KTOR-5495. I can add more info if needed. I have limited the visibility for now since this may be a security vulnerability.