@@ -25,6 +25,7 @@ module Network.Wai.Handler.WarpTLS (
2525 , tlsCiphers
2626 , tlsWantClientCert
2727 , tlsServerHooks
28+ , tlsAllowSecureRenegotiation
2829 , onInsecure
2930 , OnInsecure (..)
3031 -- * Smart constructors
@@ -117,6 +118,13 @@ data TLSSettings = TLSSettings {
117118 -- Default: def
118119 --
119120 -- Since 3.0.2
121+ , tlsAllowSecureRenegotiation :: Bool
122+ -- ^Whether or not renegotiation is used.
123+ --
124+ -- >>> tlsAllowSecureRenegotiation defaultTlsSettings
125+ -- True
126+ --
127+ -- Since 3.1.0
120128 }
121129
122130-- | Default 'TLSSettings'. Use this to create 'TLSSettings' with the field record name (aka accessors).
@@ -134,6 +142,7 @@ defaultTlsSettings = TLSSettings {
134142 , tlsCiphers = ciphers
135143 , tlsWantClientCert = False
136144 , tlsServerHooks = def
145+ , tlsAllowSecureRenegotiation = True
137146 }
138147
139148-- taken from stunnel example in tls-extra
@@ -275,7 +284,7 @@ runTLSSocket' tlsset@TLSSettings{..} set credential sock app =
275284 , (TLS.HashSHA1, TLS.SignatureRSA)
276285 , (TLS.HashSHA1, TLS.SignatureDSS)
277286 ]
278− , TLS.supportedSecureRenegotiation = True
287+ , TLS.supportedSecureRenegotiation = tlsAllowSecureRenegotiation
279288 , TLS.supportedSession = True
280289 }
281290