datatheorem / datatheorem/TrustKit

[Bug] No longer working

Open
#321 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Objective-C
Stars
2.1k
Forks
381
PR merge metrics
No merged PRs in 30d

Description

Hi,

About 1-2 months ago, I had used this library through react-native-ssl-public-key-pinning to enforce SSL pinning in my company's app on a PoC branch, which worked as expected.

And just yesterday, I tried to install and apply the library again in a new branch, but now it does not block any request to pinned domain when using invalid keys.

I'm not sure if this was the issue with react-native-ssl-public-key-pinning or with the TrustKit, but the configuration used to initialize TrustKit looks supposedly correct. (I also opened an issue there)

Logs

(iOS to MacOS Console log)

=== TrustKit: Successfully initialized with configuration {
    TSKPinnedDomains =     {
        "some-service.tech" =         {
            TSKDisableDefaultReportUri = 1;
            TSKEnforcePinning = 1;
            TSKIncludeSubdomains = 1;
            TSKPublicKeyHashes = "{(\n    {length = 32, bytes = 0x00000000 00000000 00000000 00000000 ... 00000000 00000000 },\n    {length = 32, bytes = 0x04104104 10410410 41041041 04104104 ... 04104104 10410410 }\n)}";
            kSKExcludeSubdomainFromParentPolicy = 0;
        };
    };
    TSKSwizzleNetworkDelegates = 0;
}
Versions

TrustKit: 3.0.3
CocoaPods: 1.14.3
iOS: 16.2 (iPhone Simulator)

Thanks!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported TrustKit 3.0.3 configuration on the iOS 16.2 Simulator and inspect the initialization log shown in the issue. Compare the TrustKit behavior with the related react-native-ssl-public-key-pinning integration. Done means requests to the pinned domain are blocked when invalid public-key hashes are configured.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, objective-c
Domain
mobile-dev, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.