expose a way to disable host name verification

ryber · ryber · commit 20bdada6f4da · 2025-09-02T07:42:28.000-05:00
diff --git a/unirest/src/main/java/kong/unirest/core/Config.java b/unirest/src/main/java/kong/unirest/core/Config.java
@@ -45,6 +45,7 @@
 public class Config {
     public static final int DEFAULT_CONNECT_TIMEOUT = 10000;
     public static final String JDK_HTTPCLIENT_KEEPALIVE_TIMEOUT = "jdk.httpclient.keepalive.timeout";
+    public static final String JDK_HTTPCLIENT_DISABLE_HOST_NAME_VERIFICATION = "jdk.internal.httpclient.disableHostnameVerification";
 
     private Optional<Client> client = Optional.empty();
     private Supplier<ObjectMapper> objectMapper;
@@ -898,4 +899,18 @@ public long getTTL() {
     public RetryStrategy getRetryStrategy() {
         return retry;
     }
+
+    /**
+     * Sets the system property jdk.internal.httpclient.disableHostnameVerification
+     *
+     * Disables or enables HostNameVerification for the ENTIRE JVM. This will impact all consumers of
+     * Unirest, java.net.http.HttpClient, or other consumers of either.
+     *
+     * @param enabled boolean value for property. true DISABLES host name verification
+     * @return this config object
+     */
+    public Config disableHostNameVerification(boolean enabled) {
+        System.setProperty(JDK_HTTPCLIENT_DISABLE_HOST_NAME_VERIFICATION, String.valueOf(enabled));
+        return this;
+    }
 }
diff --git a/unirest/src/test/java/kong/unirest/core/ConfigTest.java b/unirest/src/test/java/kong/unirest/core/ConfigTest.java
@@ -142,6 +142,15 @@ void requestTimeoutCannotBeNegative() {
         assertThrows(IllegalArgumentException.class, () -> config.requestTimeout(-5));
     }
 
+    @Test
+    void disableHostNameVerification() {
+        assertNull(System.getProperty(Config.JDK_HTTPCLIENT_DISABLE_HOST_NAME_VERIFICATION));
+        config.disableHostNameVerification(true);
+        assertEquals("true", System.getProperty(Config.JDK_HTTPCLIENT_DISABLE_HOST_NAME_VERIFICATION));
+        config.disableHostNameVerification(false);
+        assertEquals("false", System.getProperty(Config.JDK_HTTPCLIENT_DISABLE_HOST_NAME_VERIFICATION));
+    }
+
     private void assertProxy(String host, Integer port, String username, String password) {
         assertEquals(host, config.getProxy().getHost());
         assertEquals(port, config.getProxy().getPort());
