For the Wrong Key also gets Success 200 - Android

[chathuralakmal]

I have followed the instruction of installing the library. and in App.js i have added the following.

` try {
await initializeSslPinning({
'google.com': {
includeSubdomains: true,
publicKeyHashes: [
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=',
'BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=',
],
},
})
.then((response) => {
console.log('THIS CALLED (1) ', response);
})
.catch((e) => {
console.log('ERROR ####', e);
});
} catch (error) {
console.log('ERROR ****', error);
}

// ...

// This request should fail with an error
try {
const response = await fetch('https://google.com');
console.log('RESPOSNSE (1) -----> ', response.status);
} catch (error) {
console.log('ERROR ', error);
}`

This always returns 200.

"react-native": "0.63.2",
"react-native-ssl-public-key-pinning": "^1.0.6",

[frw]

Could you create a repository with a minimal reproducible example?
You can also check out the example app and see what's different with your setup: https://github.com/frw/react-native-ssl-public-key-pinning/tree/main/example

[frw]

Also, try changing this line

const response = await fetch('google.com');

to this line

const response = await fetch('https://google.com');

By default fetch is done over HTTP, which will not be affected by our pinning.

[chathuralakmal]

@frw The example I downloaded it works fine. i cannot understand why it does not work in my app. could it be because of the react-native version?

[abhishekrup]

@chathuralakmal try running without debug you will get the correct response i think because i was also getting same issue but i disabled the debug and run then i am getting proper response

[chathuralakmal]

@abhishekrup @frw I Just found out it works fine in iOS. I believe may be its because it's using TrustKit. will try out trust kit android.

[frw]

@chathuralakmal @abhishekrup

I just found out that if your React Native Android version is below 65, you have to set includeSubdomains: false and match your domains exactly. This is because RN Android v64 and below still uses OkHttp v3, and wildcard domain support (which this library relies on for includeSubdomains) was only introduced in OkHttp v4.3. This could be the reason why you're not seeing your domains pinned.

Try the following code instead:

await initializeSslPinning({
  'www.google.com': {
    publicKeyHashes: [
      'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=',
      'BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=',
    ],
  },
});

// ...

// This request should fail with an error
const response = await fetch('https://www.google.com');

[frw]

Closing since the issue seems to be with an older RN version and workarounds have been provided.
Let me know if you're still facing any issues!