Uhlelo lwe-Expo luhluleka ku-HTTP ku-Android 9: yi-cleartext, hhayi i-VPN

Ukwakhiwa kwe-Expo okushaya i-API ye-HTTP evamile kuhluleka ku-Android 9 nangemuva. Umhubhe awunacala: ifulegi le-cleartext likusimongweni wokwakha.

Ukhiphe ukwakhiwa okusha, wadlulela ku-VPN, futhi isikrini esifanayo sayeka ukulayisha. Ku-Android 9 nangemuva incazelo evame kakhulu iyisicefe: ipulatifomu iyenqaba i-HTTP evamile kumahlelo akhomba ku-API 28 noma ngaphezulu, futhi i-VPN yashintsha umongo owanele ukukuveza. Iphutha olibonayo lincike kuklayenti ye-HTTP, yingakho lingasho i-cleartext kaningi.

Lena nhluleka iyini ngempela

Kusukela ku-Android 9 ipulatifomu ivimba i-cleartext ngokuzenzakalela ngokushesha lapho uhlelo lukhomba ezingeni le-API 28 noma ngaphezulu. Isicelo esiya ekhelini le-HTTP evamile senqatshwa ipulatifomu ngaphambi kokuba ngisho iphakethe elilodwa liphume kudivayisi. Ukuthi yiliphi iphutha ozolibona kuncike kulabhulali ye-HTTP: ngezinye izikhathi ukwehluleka kwenethiwekhi okuvamile, ngezinye isikhathi isikhathi siphelile, ngezinye umlayezo osho ngqo i-cleartext. Engakwenzi neze ukufika kuseva yakho. I-Android ibhala phansi okuzenzakalelayo nokunye okulinganiselwe kusizinda emhlahlandlelweni wayo wokumisa ukuphepha.

Isiphequluli kudivayisi efanayo sisengalayisha ikhasi, futhi yilokho okushiwo abantu abaningi abakushiyayo. Izithequluli azilawulwa inqubomgomo yokuphepha kwenethiwekhi yohlelo lwakho.

Kungani kusolwa i-VPN

Ngokuvamile izinto ezintathu zishintsha ngesikhathi esisodwa. Uhlelo lungaxazulula igama lomsingathi elihlukile ngemva kokuxhuma kwe-VPN, idivayisi ingaba yintsha enokwakhiwa okusha, noma ukwakhiwa uqobo kungase kudlulele ezingeni le-API eliqondiwe elivusa okuzenzakalelayo. I-VPN iyabonakala kanti i-SDK eliqondiwe ayibonakali, ngakho i-VPN ithola ithikithi.

Qhathanisa amazinga aqondiwe okwakhiwa okudala nokusha ngaphambi kokuthinta ukumisa kwenethiwekhi. Uhlelo olukhomba ku-27 noma ngaphansi alukho emthethweni, futhi lokho kuchaza yonke imibiko ethi «kusebenza ocingweni lwami oludala».

Ifulegi le-Expo lihlala kuphi ngempela

Kuphrojekthi ye-Expo ephethwe, ukwengeza isilungiselelo ku-app.json akuhleli i-manifest ye-Android, ngoba i-prebuild nokwakhiwa kwentuthuko yikho okukhiqiza i-manifest. Ingxenye yokumisa eyengeziwe yiyo ebhala isilungiselelo kuleso sigaba. Indlela esekelwayo i-expo-build-properties, emiswa ekumiseni kohlelo ngenketho ye-cleartext ngaphansi kwe-android.

{
  "plugins": [
    ["expo-build-properties", {
      "android": { "usesCleartextTraffic": true }
    }]
  ]
}

Isiqephu sibeka kuphela inketho yengxenye eyengeziwe; i-manifest ikhiqizwa kamuva. Qalisa i-prebuild noma ukwakhiwa okusha kweklayenti yentuthuko, bese ngaphambi kokuphinda uhlole hlola i-AndroidManifest.xml ekhiqiziwe mayelana ne-android:usesCleartextTraffic, ngoba ukulayisha kabusha nge-JS kuphela kugcina i-manifest endala. Fansanisa inguqulo yengxenye eyengeziwe ne-Expo SDK iphrojekthi egijima kuyo. Izinketho zengxenye eyengeziwe ziyashintsha phakathi kwezinguqulo, futhi isiqephu esikopishwe kusuka kwenye i-SDK siwumthombo othembekile wokungenzi lutho buthule.

Uhlelo lwe-bare nendlela encane

Kubare React Native okulinganayo i-android:usesCleartextTraffic kusici se-application, noma ukumisa kokuphepha kwenethiwekhi okuvumela i-cleartext kumasizinda aqanjwe kuphela. Ifomu elilinganiselwe kusizinda yilo okufanele likhethwe, ngoba livumela i-API yangaphakathi futhi lishiya konke okunye ku-HTTPS. Libhala futhi uhlu lwalo lwezimvume, futhi yilokho okuzobuzwa umhloli.

Awekho kulezi zindlela ezimbili ashintsha okuzenzakalelayo kwepulatifomu kunoma yini ongayichazanga.

Qala ukuqinisekisa ngelogi yedivayisi

Ngaphambi kokuhlela ukumisa, thola ukwehluleka okuqondile. adb logcat kudivayisi exhunyiwe kukhombisa ukwenqatshwa kwe-cleartext yipulatifomu futhi kusho ingxenye eyikhiphile. Isokhethi enqatshiwe, igama elingaxazululeki noma ukuxhawulana kwe-TLS okuhlulekile kukhomba kwenye indawo ngokuphelele, futhi ukuvula i-cleartext kuzokwenza uhlelo lube buthaka ngeze.

Bese ugcina ukukhiqiza kuthembekile. I-cleartext iyamukeleka endaweni yokugcina yaselabhorethri engakwazi ukunikeza i-TLS, futhi kuphela isikhathi esifushane kakhulu ongasihlela. Uma i-API ingaqeda i-TLS ngaphakathi kwenethiwekhi yangasese, faka isitifiketi esitolo sokuthembela sedivayisi futhi ushiye i-cleartext ivaliwe, ngoba umhubhe ubethela indlela kuze kufike ekuphumeni kwawo hhayi okunye ngale.

Lapho indawo yokugcina isiphendula nge-HTTPS, susa imvume, wakhe kabusha futhi uhlole ku-VPN naku-Wi-Fi evamile kuseshini eyodwa. Ukuxazululwa kwamagama kungahluka phakathi kwalezi zindlela ezimbili, futhi yipheya kuphela elikutshela ukuthi yiluphi olukhuluma iqiniso.

Izihloko ezihlobene