Closed ShulmanK closed 1 month ago
Hi @ShulmanK,
What version of React Native are you using with this library? Are you using Expo in your setup?
If you can please provide a repository with a minimal reproducible example.
You can check out the example repository for a working setup: https://github.com/frw/react-native-ssl-public-key-pinning/tree/main/example
Hi @frw , Thank you for your answer. I tried to install new react-native project (without expo) using latest version 0.74.3 and reproduce the code from your example and app requests are still doable with incorrect pin.
This is a link to repository: https://github.com/ShulmanK/ssl-pinning-example
https://github.com/user-attachments/assets/9b1fbd80-9e93-4937-9b0b-a2568e19f151
I attached some screencast. As you can see fetch request to the google.com are successful even with incorrect pin. Is there a chance I'm doing smth wrong. I would happy if you can point me it out.
Also my package.json
{
"name": "AwesomeProject",
"version": "0.0.1",
"private": true,
"scripts": {
"android": "react-native run-android",
"ios": "react-native run-ios",
"lint": "eslint .",
"start": "react-native start",
"test": "jest"
},
"dependencies": {
"react": "18.2.0",
"react-native": "0.74.3",
"react-native-ssl-public-key-pinning": "^1.2.4"
},
"devDependencies": {
"@babel/core": "^7.20.0",
"@babel/preset-env": "^7.20.0",
"@babel/runtime": "^7.20.0",
"@react-native/babel-preset": "0.74.85",
"@react-native/eslint-config": "0.74.85",
"@react-native/metro-config": "0.74.85",
"@react-native/typescript-config": "0.74.85",
"@types/react": "^18.2.6",
"@types/react-test-renderer": "^18.0.0",
"babel-jest": "^29.6.3",
"eslint": "^8.19.0",
"jest": "^29.6.3",
"prettier": "2.8.8",
"react-test-renderer": "18.2.0",
"typescript": "5.0.4"
},
"engines": {
"node": ">=18"
},
"packageManager": "yarn@3.6.4"
}
And Pins I used:
const GTS_HASHES = [
'CLOmM1/OXvSPjw5UOYbAf9GKOxImEp9hhku9W90fHMk=wrongpart', // GlobalSign R4
// 'hxqRlPTu1bMS/0DITB1SSu0vd4u/8l8TjPgfaAp63Gc=', // GTS Root R1
// 'Vfd95BwDeSQo+NUYxVEEIlvkOlWY2SalKK1lPhzOx78=', // GTS Root R2
// 'QXnt2YHvdHR3tJYmQIr0Paosp6t/nggsEGD4QJZ3Q0g=', // GTS Root R3
// 'mEflZT5enoR1FuXLgYYGqnVEoZvmf9c2bVBpiOjYQ0c=', // GTS Root R4
].join('\n');
I would appreiate if you can take a look. Thank you in advance!
Hey @ShulmanK
When you click on "Initialize Pinning", there is an error message which complains about invalid SHA256 hashes (they are invalid because you appended some stuff at the end of the hash). This means that the pinning hasn't actually succeeded. You should be using actual SHA256 hashes, but the hashes shouldn't match your certificate's public key hash if you want to see the fetch
fail.
For examples of failing hashes, you can check the FAQ (here's an example of one: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
. Note that this is a valid SHA256 hash but will probably not match the public key hash of any server's certificate)
I added my host and public key to the index.js page. Getting a network error even though I added the correct hostname and public key. I tested it on an Android 14 device. react-native:0.68.7 react-native-ssl-public-key-pinning: 1.1.3
I have a small question: Is the hostname and base URL we are using should be the same?
example: hostname: myhost.com Base URL: www.myhost.com
await initializeSslPinning({ 'host': { includeSubdomains: true, publicKeyHashes: [ 'publickey', ], }, });
@gkasireddy202,
Please provide a repository with a minimal reproducible example, as well as any relevant error messages you get. I am unable to tell why your particular setup does not work without them.
You should be able to use myhost.com
and set includeSubdomains: true
to pin all subdomains of myhost.com
, including www.myhost.com
Do try to use the latest version of the library as well.
@frw - Thanks for your reply. I am facing with hostname:myhost.com and base URL: www.cloud.myhost.com. I resolved the issue by adding the hostname:www.cloud.myhost.com.
Closing for inactivity. Please reopen if you're still having issues.
I have implemented this library to restrict users from making API requests when incorrect pins are provided.
It appears that only the initializeSslPinning function is working correctly. This function checks the pins and throws an error if they are incorrect. However, despite incorrect or missing pins, API calls are still successful on iOS and android.
Steps to Reproduce:
Expected Behavior:
API requests should fail when incorrect pins are provided.
Actual Behavior:
API requests succeed even when incorrect or missing pins are provided.