Secure backend socket.io from other applications that can access localhost i.e. browser #1940
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…om main.ts to backend and state manager
leblowl
reviewed
Oct 11, 2023
siepra
approved these changes
Oct 18, 2023
leblowl
suggested changes
Oct 25, 2023
packages/mobile/android/app/src/main/java/com/quietmobile/Backend/BackendWorker.kt
Outdated
Show resolved
Hide resolved
|
|
||
| return randomString; | ||
| } | ||
|
|
There was a problem hiding this comment.
We should probably use something like: https://developer.apple.com/documentation/security/1399291-secrandomcopybytes
and maybe call it generateSecret to match other implementations.
|
|
||
| return randomString | ||
| } | ||
| } |
There was a problem hiding this comment.
Same comment as above
We should probably use something like: https://developer.apple.com/documentation/security/1399291-secrandomcopybytes
and maybe call it
generateSecretto match other implementations.
Also it looks like this is a duplicate of the same function in AppDelegate.m
EmiM
added a commit
that referenced
this pull request
Nov 23, 2023
* Fix - js injection in message input (#1943) * use notarytool for macos notarization * Secure backend socket.io from other applications that can access localhost i.e. browser (#1940) * secure socket IO connection with token and origin, transform token from main.ts to backend and state manager * Add authorization headers to socketio android notifications client * Secure socketIO connection on iOS * Extend lastKnownPort to lastKnownSocketIOData on android * Handle socketIOSecret for iOS lifecycle event * feat: getRandomValues and concept for validating options on backend * fix: use secure crypto for ios socketio secret --------- Co-authored-by: Vin Kabuki <[email protected]> Co-authored-by: siepra <[email protected]> * feat: notifier component #1980 * feat: use mailto for support address #1980 * fix: building mobile package #1980 * Publish - @quiet/[email protected] - @quiet/[email protected] - [email protected] - [email protected] - [email protected] - @quiet/[email protected] - @quiet/[email protected] * fix: pass team id for notarization * chore: abort build on notarization failure (#2081) * chore: deactivate 'breaking changes warning' for mobile and desktop #2097 #2096 * fix: use default websocket port in case of none --------- Co-authored-by: Kacper Michalik <[email protected]> Co-authored-by: Vin Kabuki <[email protected]> Co-authored-by: Kacper-RF <[email protected]> Co-authored-by: siepra <[email protected]> Co-authored-by: Wiktor Sieprawski <[email protected]> Co-authored-by: [email protected] <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull Request Checklist
(Optional) Mobile checklist
Please ensure you completed the following checks if you did any changes to the mobile package: