react-native-ssl-public-key-pinning icon indicating copy to clipboard operation
react-native-ssl-public-key-pinning copied to clipboard

[Bug][iOS] Not working with expo-dev-client in debug build

Open quaos opened this issue 1 year ago • 26 comments

Hi, About 1-2 months ago, I had used this library to enforce SSL pinning in my company's app on a PoC branch, which worked as expected.

And just today, I tried to install and apply the library again in a new branch, but now it does not block any request to pinned domain when using invalid keys.

Already run cd ios && pod install then expo run:ios

UPDATE (2024-01-24):

Configuration

(Testing invalid keys case)

{
  "some-service.tech": {
    "includeSubdomains": true,
    "publicKeyHashes": [
      "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
      "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB="
    ]
  }
}

Logs

(iOS to MacOS Console log)

=== TrustKit: Successfully initialized with configuration {
    TSKPinnedDomains =     {
        "some-service.tech" =         {
            TSKDisableDefaultReportUri = 1;
            TSKEnforcePinning = 1;
            TSKIncludeSubdomains = 1;
            TSKPublicKeyHashes = "{(\n    {length = 32, bytes = 0x00000000 00000000 00000000 00000000 ... 00000000 00000000 },\n    {length = 32, bytes = 0x04104104 10410410 41041041 04104104 ... 04104104 10410410 }\n)}";
            kSKExcludeSubdomainFromParentPolicy = 0;
        };
    };
    TSKSwizzleNetworkDelegates = 0;
}

Versions

  • react-native-ssl-public-key-pinning: 1.1.3
  • TrustKit: 3.0.3
  • Axios: 0.25.0
  • Expo: 49.0.13
  • RN: 0.72.6
  • CocoaPods: 1.14.3
  • iOS: 16.2 (iPhone Simulator)

Thanks!

quaos avatar Jan 03 '24 11:01 quaos