statianzo / Fleck

C# Websocket Implementation
MIT License
2.28k stars 583 forks source link

I think “SslProtocols.None” should be the default value #270

Open katatema opened 5 years ago

katatema commented 5 years ago

The Fleck server seems to have selected "SslProtocols.Tls" as the default value for "SslProtocols".

https://github.com/statianzo/Fleck/blob/2f5365ed229030d0c62b08dd511b9e7da3eb68c3/src/Fleck/WebSocketServer.cs#L95-L99

I think that if "EnabledSslProtocols" equals "SslProtocols.None", "SslProtocols.None" should be set as it is. If you select SslProtocols.None, the best security protocol and version for your OS will be selected.

Please refer to the following document. https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls

Chrome, Edge, IE, Firefox, and Safari to disable TLS 1.0 and TLS 1.1 in 2020. I think it is better to choose "SslProtocols.None".