CODEWITHSUNDEEP
android-security
user3796467
user3796467

Reputation: 57

What is the best practice to deal with Google Play Store Security Alert?

I have received the following error from Google Play developer console: "Please address this vulnerability as soon as possible and increment the version number of the upgraded APK. To properly handle SSL certificate validation, change your code to invoke SslErrorHandler.proceed() whenever the certificate presented by the server meets your expectations, and invoke SslErrorHandler.cancel() otherwise."

I guess the issue is caused by my implementation of "onReceicedSslError()". I always proceed with "handler.proceed()" without any checking.

I would like to know what is the best practice to deal with SSL error. And if I do some domain checking, will Google Play still show me such alert?

Thanks in advance.

Upvotes: 4

Views: 411

Answers (1)

Antimony
Antimony

Reputation: 39451

You should just remove your onReceivedSslError implementation and use the default behavior, which is to cancel.

The best practice is to treat it like you couldn't connect to the server. Most people have no reason to override certificate checking at all.

Upvotes: 1

Related Questions