frw / react-native-ssl-public-key-pinning

Simple and secure SSL public key pinning for React Native. No native configuration needed, set up in <5 minutes.
MIT License
157 stars 13 forks source link

Network calls via FastImage are not being SSL Pinned #313

Open amanmoar277 opened 3 months ago

amanmoar277 commented 3 months ago

In my react-native app, I want to do SSL pinning only for IOS. So, I have pinned a domain (assume aaa.bbb.com, this domain serves me the images).

I am making calls to this domain to fetch the images by two ways

  1. Directly using axios
  2. Using FastImage - https://www.npmjs.com/package/react-native-fast-image

When I run my application by putting some wrong hash. if (Platform.OS === 'ios') await initializeSslPinning({ 'aaa.bbb.com': { includeSubdomains: true, publicKeyHashes: [ 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', 'BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=', ], } })

I can see that the calls made via axios are being pinned successfully and there is no response. But the calls made via FastImage gave back 200 StatusCode.

Is this something expected from this library because FastImage uses SDWebImage and SDWebImage is not supported by this library.

If it is supported - Is there anything wrong that I am doing in the above code? If fastImage is still not supported - Is there any plan to support this library in future?

frw commented 3 months ago

Hey @amanmoar277

Unfortunately, react-native-fast-image fetches images via it's own implementation of network requests, separate from the React Native networking API. This means that the network requests by fast-image would not be affected by this library, per this note.

No plans to support it at the moment (also because it seems like fast-image is no longer being actively maintained), but it seems like it's doable to add pinning to the underlying libraries if anyone wants to take a crack at it: https://bumptech.github.io/glide/doc/configuration.html#libraries https://github.com/SDWebImage/SDWebImage/wiki/Advanced-Usage#custom-download-operation-40