Network calls via FastImage are not being SSL Pinned

[amanmoar277]

In my react-native app, I want to do SSL pinning only for IOS. So, I have pinned a domain (assume aaa.bbb.com, this domain serves me the images).

I am making calls to this domain to fetch the images by two ways

1. Directly using axios
2. Using FastImage - https://www.npmjs.com/package/react-native-fast-image

When I run my application by putting some wrong hash.
if (Platform.OS === 'ios')
await initializeSslPinning({
'aaa.bbb.com': {
includeSubdomains: true,
publicKeyHashes: [
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=',
'BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=',
],
}
})

I can see that the calls made via axios are being pinned successfully and there is no response. But the calls made via FastImage gave back 200 StatusCode.

Is this something expected from this library because FastImage uses SDWebImage and SDWebImage is not supported by this library.

If it is supported - Is there anything wrong that I am doing in the above code?
If fastImage is still not supported - Is there any plan to support this library in future?

[frw]

Hey @amanmoar277

Unfortunately, react-native-fast-image fetches images via it's own implementation of network requests, separate from the React Native networking API. This means that the network requests by fast-image would not be affected by this library, per this note.

No plans to support it at the moment (also because it seems like fast-image is no longer being actively maintained), but it seems like it's doable to add pinning to the underlying libraries if anyone wants to take a crack at it:
https://bumptech.github.io/glide/doc/configuration.html#libraries
https://github.com/SDWebImage/SDWebImage/wiki/Advanced-Usage#custom-download-operation-40

[amanmoar277]

Hi @frw, does it make any difference if we use TrustKit at native side directly instead of using this lib?
Could you please help me understanding this?

[dougg0k]

react-native-nitro-image is one that is being maintained.

---

Android side uses https://github.com/coil-kt/coil which are making use of https://ktor.io/docs/client-ssl.html

https://medium.com/@MrHardikTrivedi/public-key-pinning-using-ktor-for-android-and-ios-kmm-61066cb34321

---

iOS side uses https://github.com/SDWebImage/SDWebImage which are making use of https://developer.apple.com/documentation/foundation/urlsession

https://medium.com/@ahmed.elmemy21/implementing-certificate-pinning-in-ios-enhancing-app-security-fec46a0df676

---

Fastimage uses Glide, which has integration with okhttp3

https://square.github.io/okhttp/features/https/#certificate-pinning-kt-java

https://futurestud.io/tutorials/glide-module-example-accepting-self-signed-https-certificates

---

This is probably useful to have implemented, not only for image related, but other packages could also eventually be using them for whatever reason.

Plus, this would be useful in the scenario from this issue, if it gets implemented #183