Open eliasp opened 11 months ago
Hi Elias, thanks for reporting. You are correct, SSL errors are currently simply ignored. This decision had to do with client certificates, but I'm sure this will be improved in the future. However, there are currently more important bugs, so this unfortunately might have to wait until the app itself is in a more stable state (which I am currently working on).
I consider this issue very important, so I am willing to try (no guarantees!) to send a pull request to fix it (in few weeks), if it is ok with you @astubenbord
Sure, I can point you to some locations in code.
Sure, I can point you to some locations in code.
I think I found the point where the check is done: https://github.com/astubenbord/paperless-mobile/blob/162d50bf706bc13d929f4ba45f98a8b9bf84e656/lib/core/security/session_manager.dart#L36
The idea is to check there the validity against a list of allowed certificates (by using the certificate fingerprint). Ideally, a certificate is added to the list by the user explicitly. To simplify, I'd say that, when the certificate is not valid, the app should ask the user if they want to trust the certificate anyway.
What do you think?
Sounds good to me. Do you want to work on this or do you want me to have a look?
I will try :-)
I started working on something, but... life happens, and I won't be able to spare much time in the next few weeks. If you need to implement this quickly, feel free to take over. I will check the issue as soon as I have the free time again :-)
No worries, I know how it is ;) If I find the time, I'll have a look.
Before submitting a bug report
Describe the bug When using an untrusted/self-signed certificate on the webserver hosting paperless-ngx, the app ignores this. This renders TLS ineffective, since this means anyone could intercept the connection and redirect it to another host with a fake certificate.
To Reproduce Steps to reproduce the behavior:
Expected behavior
Screenshots![Screenshot_20230915-231151](https://github.com/astubenbord/paperless-mobile/assets/48491/d02ccab0-dff4-41b7-963d-709eed53cb03)
Device Information:
Additional context I also went through the commits between the release I'm using (2.3.9) and
development
- there was one related to error handling, but it seems this one doesn't address this issue.From what I can tell (with zero Dart knowledge) is, that the current TLS error handling only addresses issues with the client certificate.