nativescript-community / nativescript-community/https

Public key pinning support

未关闭
#1 12 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

enhancement
主要语言
Vue
星标
52
派生
40
PR 合并指标
30 天内没有已合并 PR

描述

I see that cert pinning is supported, but how much extra work would it be to add a method for pinning just a public key?

This would be much more convenient in most cases I think, given that key pairs are generally long-lived while certificates change on a regular basis — more so now with the rising popularity of Let's Encrypt which issues 90-day certs. With public key pining, I can just commit the public key (or hash) as a static file once and forget about it, whereas it seems like cert pinning would require me to implement additional logic to ensure that the latest version of the cert is always stored locally.

(Note: I've looked at the readme, but haven't yet used this library or done much digging into how Android, iOS, or the linked libraries handle TLS pinning; so my assumptions about what is and/or can be supported may be completely off.)

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue,再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库,在一个分支上完成修改。
  4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

调研方向

从 README 中现有的 certificate-pinning 描述开始,然后检查 issue 中提到的 Android 和 iOS TLS-pinning 集成。确定所链接的库是否支持公钥 pinning 或哈希 pinning,并定义所需的 API 和验证行为;确定出可实施的范围即表示完成。

由索引模型根据 Issue 内容生成。

评估

技术栈
android, ios
领域
mobile-dev, security
Issue 类型
功能
难度
5/5
预计耗时
一周以上
活跃度
停滞
描述清晰度
需要澄清
新手友好度
25/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。