Public key pinning support

未关闭
#1 12 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
功能
描述清晰度
需要澄清
活跃度
停滞
技术栈
android, ios
领域
mobile-dev, security

调研方向

从 README 中现有的 certificate-pinning 描述开始，然后检查 issue 中提到的 Android 和 iOS TLS-pinning 集成。确定所链接的库是否支持公钥 pinning 或哈希 pinning，并定义所需的 API 和验证行为；确定出可实施的范围即表示完成。

由索引模型根据 Issue 内容生成。

描述

enhancement

I see that cert pinning is supported, but how much extra work would it be to add a method for pinning just a public key?

This would be much more convenient in most cases I think, given that key pairs are generally long-lived while certificates change on a regular basis — more so now with the rising popularity of Let's Encrypt which issues 90-day certs. With public key pining, I can just commit the public key (or hash) as a static file once and forget about it, whereas it seems like cert pinning would require me to implement additional logic to ensure that the latest version of the cert is always stored locally.

(Note: I've looked at the readme, but haven't yet used this library or done much digging into how Android, iOS, or the linked libraries handle TLS pinning; so my assumptions about what is and/or can be supported may be completely off.)

主要语言
Vue
星标
52
派生
40
30 天内没有已合并 PR

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

nativescript-community/https 的其他 Issue

查看 nativescript-community/https 的全部 Issue

相似的 Issue

更多 Mobile Dev Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。