search

nativescript-community / https

Secure HTTP client with SSL pinning for Nativescript - iOS/Android
https://nativescript-community.github.io/https/
Other
50 stars 42 forks source link

Override always default Android hostname verifier #23

Open Guatom opened 6 years ago

Guatom commented 6 years ago

This fixes the following problem:

javax.net.ssl.SSLPeerUnverifiedException: Hostname WWW.XXX.YYY.ZZZ not verified:
... ...
subjectAltNames: [] ; Zone: <root> ; Task: Promise.then ; Value: javax.net.ssl.SSLPeerUnverifiedException: Hostname WWW.XXX.YYY.ZZZ not verified:

A couple of months ago, Android stopped accepting self-signed certificates without SAN value when performing a WS call. I took a look at nativescript-https's code and there's this option validatesDomainName: if false, it uses default Android hostname verification which throws the mentioned error; if true, it uses a custom hostname verifier.

With my proposed change, the custom verifier will always be used, but it will return true if validatesDomainName === false and will use current logic if validatesDomainName === true. This can be returned some lines before, just at the beginning of verify and save some processing, but I think it looks fancier this way. I'll modify the code if needed.

I used this for a development environment and I thought it was useful since I saw some people having the same problem. I think this could be useful for someone else.

Best regards from _travelDevs.

Guatom commented 6 years ago

Hey @roblav96! Any chance for this to get merged?

Thanks in advance.

jjonly commented 4 years ago

@Guatom You mentioned, that Android requires a SAN value for self-signed certificates. I can't find any information or documentation for this. Do you by any chance have a source for this info? Thanks in advance!

Guatom commented 4 years ago

@jjonly sorry my friend! I don't know why I hadn't been notified about this. Do you still need help?