[Android Auto] Investigate how we need to handle trusted hosts

@kmadsen commented on Thu May 27 2021

The car library has a HostValidator

Which essentially makes the 1tap app a trusted host with the head unit. You can find where this is in the MainCarAppService. I don't fully understand either, so this ticket is to figure it out and share your findings.

class MainCarAppService : CarAppService() {
    override fun createHostValidator(): HostValidator {
        return HostValidator.ALLOW_ALL_HOSTS_VALIDATOR
        // TODO limit hosts for production
        //    https://github.com/mapbox/1tap-android/issues/988
//        return HostValidator.Builder(this)
//                .addAllowedHosts(R.array.android_auto_allow_list)
//                .build()
    }

    override fun onCreateSession(): Session {
        return MainCarSession()
    }
}

Beginne mit MainCarAppService und der verlinkten AndroidX HostValidator-Dokumentation. Konzentriere dich auf die aktuelle ALLOW_ALL_HOSTS_VALIDATOR-Konfiguration und die auskommentierte Allow-List-Alternative. Dokumentiere, wie vertrauenswürdige Hosts in der Produktion behandelt werden sollten, und teile die Erkenntnisse und die Empfehlung im Issue.