Search code examples
react-nativesecuritysslcross-platformcertificate-pinning

Trouble implementing react-native-ssl-pinning with axios in React Native


I'm facing an issue while trying to implement SSL pinning using the react-native-ssl-pinning library in my React Native project. Specifically, I'm using React Native version 0.71.8.

Both react-native-ssl-pinning and react-native-cert-pinner are failing

I followed the documentation and installed the necessary dependencies. However it throws this error enter image description here

Here are the steps I've taken so far:

  1. npm install axios react-native-ssl-pinning
  2. Import the necessary modules
  3. Configure the SSL pinning certificates (RNSSLPinning.pinningCheck(certificates);)

Solution

  • I resolved using this approach

    1. For IoS - using TrustKit
    2. For Android - using OkHttp

    IOS

    1. Open your app's AppDelegate.m file

    2. Import the TrustKit headers by adding the following line at the top of the file:

      #import <TrustKit/TrustKit.h>

    3. Inside the application:didFinishLaunchingWithOptions: method, configure TrustKit with your desired SSL pinning policy. For example:

      (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)launchOptions { // Your other code...

      NSDictionary *trustKitConfig = @{
          kTSKSwizzleNetworkDelegates: @YES,
          kTSKPinnedDomains: @{
              @"example.com": @{
                  kTSKPublicKeyHashes: @[
                      @"<public_key_hash_1>",
                      @"<public_key_hash_2>"
                  ],
                  kTSKEnforcePinning: @YES
              }
          }
      };
      
      [TrustKit initializeWithConfiguration:trustKitConfig];
      
      // Your other code...
      
      return YES;
      

      }

      Replace example.com with the hostname of the server you want to pin certificates for. <public_key_hash_1> and <public_key_hash_2> should be replaced with the SHA-256 hashes of the public keys from the server's SSL certificate. You can obtain these hashes using tools like OpenSSL.

      Note that you may have multiple pinned domains in the kTSKPinnedDomains dictionary if you want to pin certificates for multiple servers.

    4. Build and run your React Native app