datatheorem / TrustKit-Android

Easy SSL pinning validation and reporting for Android.
MIT License
583 stars 87 forks source link

Wrong public key not blocking the API request. #105

Open MahaleTushar opened 1 year ago

MahaleTushar commented 1 year ago

Describe the bug I have added the wrong public key in network_security_config file, still the API request is working fine. I am using Volley for network request.

`
HurlStack sslHurlStack = new HurlStack() { @Override protected HttpURLConnection createConnection(URL url) throws IOException {

                    HttpsURLConnection httpURLConnection = (HttpsURLConnection) super.createConnection(url);
                    try {
                        httpURLConnection.setSSLSocketFactory(TrustKit.getInstance().getSSLSocketFactory(url.getHost()));
                    } catch (Exception e) {
                    }
                    return httpURLConnection;
                }
            };

                RequestQueue mRequestQueue  = Volley.newRequestQueue(context, sslHurlStack);

            `

Expected behavior The API request should fail when the Public key added in network_security_config is incorrect

App details: