search

datatheorem / TrustKit-Android

Easy SSL pinning validation and reporting for Android.
MIT License
584 stars 87 forks source link

Question reg design of TrustManager #44

Closed yashasvigirdhar closed 5 years ago

yashasvigirdhar commented 5 years ago

hello,

first of all, thanks a lot for creating this library. I am using it in my personal projects.

However, I've a question.

Why are we creating a new trust manager for each hostname? Can't we have a single trust manager which takes care of all the hosts?

I am providing a singleton okhttp client through Dagger to all the consumers in my app. If I could initialize it at there itself with a custom trustmanager that handles all the urls, I won't have to install the trustmanager in every consumer's class (the classes which use retrofit and and I need to provide them okhttp), which I'd have to do it right now.

so just curious, is there any specific reason behind this design?

Thank you.

yashasvigirdhar commented 5 years ago

The same question applies to SSLSocketFactory also btw.

jobot0 commented 5 years ago

Hey @yashasvigirdhar thanks for your feedback ! The limitation is mostly due to how the http connections are working in Android and we needed a common API to manage different client/lib. Also the other part of this limitation is due to the API we're based on as you can see here. Both block us to provide a dynamic way to handle multiple hostnames and supporting a lot of Android version 😅 Please let me know if you want more details also don't hesitate to use our Gitter to communicate directly with us :)