| Page Properties | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
|
| Table of Contents | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
Overview
Public key pinning is provided using the Android Network Security Configuration and TrustKit. To use public key pinning, you can either create an Android network security configuration XML file or set a custom TrustManager implementation. The network security configuration is supported natively on Android Nougat (API Level 24) and newer. For versions between API Level 21 and 23, the Gini SDK relies on TrustKit. The custom TrustManager is supported on all Android versions. We recommend reading the Android Network Security Configuration guide and the TrustKit limitations for API Levels 21 to 23.
...
| Info |
|---|
If you set different base urls URLs when instantiating with the |
| Note |
|---|
The above digests serve as an example only. You should always create the digest yourself from the Gini API’s public key and use that one (see Extract hash from pay-api.gini.net). If you received receive a digest from us then , always validate it by comparing it to the digest you created from the public key (see Extract hash from public key). Failing to validate a digest may lead to security vulnerabilities. |
...
The TrustKit configuration tag <trustkit-config> is required in order to disable TrustKit reporting and to enforce public key pinning. This is important because without it TrustKit won’t doesn’t throw CertificateExceptions if the local public keys didn’t don’t match any of the remote ones, effectively disabling pinning. The only downside of enforcing pinning is that two public key hashes are required. In the example above, we create created and used a “zero” key hash as a placeholder. Setting the same key hash twice won’t doesn’t help since key hashes are stored in a set. Ideally, you should use a backup public key hash as the second one.
...
For the library to know about the XML, you need to must set the XML resource id using the GiniCaptureDefaultNetworkService.Builder.setNetworkSecurityConfigResId() method:
...
Enable pinning with a custom TrustManager implementation
You can also take full control over which certificates to trust by passing your own TrustManager implementation to the GiniCaptureDefaultNetworkService.Builder.setTrustManager() method:
...