search

1nikolas / play-integrity-checker-app

Get info about your Device Integrity through the Play Intergrity API
MIT License
326 stars 44 forks source link

Running locally #30

Closed alexyao2015 closed 11 months ago

alexyao2015 commented 11 months ago

It seems that for non playstore apps to request an integrity token, the setCloudProjectNumber field must be set here. Without this number set, it is not possible to use a custom api server. The cloud project number can be found here using the api tester. I'm curious if you would also consider adding this as a variable that can be accessed through the local.properties file, similar to the API_URL property.

Also the API_URL specified in the readme is incorrect with a trailing / because the app itself already appends the /. Please consider correcting the documentation.

Lastly, in my use case, I modified the server a little bit so that I could use it outside of Vercel in a local Docker environment. With this, I ran into an issue where accessing my local server directly by IP in the local environment resulted in an error, so I had to add android:usesCleartextTraffic="true" to the manifest as specified here. I understand if you may not want to add this to the main app, but it would be a helpful hint to also have in the documentation.

Thanks for making this wonderful app!

1nikolas commented 11 months ago

It seems that for non playstore apps to request an integrity token, the setCloudProjectNumber field must be set here.

Yes but non playstore apps can't check for strong and basic integrity, only device. So half of the UI would become useless.

Also the API_URL specified in the readme is incorrect with a trailing / because the app itself already appends the /.

Done

so I had to add android:usesCleartextTraffic="true"

This is only required if your server is running with http (not https) which I won't embrace.

Technically you don't even need a server but it's more secure that way

alexyao2015 commented 11 months ago

Yes but non playstore apps can't check for strong and basic integrity, only device. So half of the UI would become useless.

I don't believe this is the case actually. I was able to see basic and device integrity pass with my local server.

Technically you don't even need a server but it's more secure that way

I guess for just a checker app, does the security really matter since there isn't any sort of "secure" method that you are checking?

Thanks for the quick update!

1nikolas commented 11 months ago

I don't believe this is the case actually. I was able to see basic and device integrity pass with my local server.

When I first made this app, this was how it worked. Now I have no idea

I guess for just a checker app, does the security really matter since there isn't any sort of "secure" method that you are checking?

Works now, I'm not touching it :P