search

Rapsssito / react-native-tcp-socket

React Native TCP socket API for Android, iOS & macOS with SSL/TLS support.
MIT License
303 stars 81 forks source link

Using a pinned certificate will always incorrectly trust peer on iOS #184

Open jakobjohansson opened 6 months ago

jakobjohansson commented 6 months ago

Description

Due to a condition in didReceiveTrust combined with _checkValidity only being set locally, the trust evaluation will yield false positive results and exit early when using a pinned certificate.

This should potentially be a security risk if providing a certificate using the ca property since the library essentially skips certificate validation.

Steps to reproduce

Steps to reproduce the behavior:

  1. Connect to a server with connectTLS
  2. Use a pinned certificate that doesn't match the server certificate

Current behavior

The code exits early and connects without validating the certificate.

Expected behavior

The certificate should be validated and connection should be dropped.

jakobjohansson commented 5 months ago

Bump @Rapsssito