Google Play Security Alert - Your app is using an unsafe implementation of the HostnameVerifier

android google-play android-security
Priyank Patel picture Priyank Patel · Dec 2, 2016 · Viewed 17.4k times · Source

Recently one of my app got a security alert from Google Play as below.

You app is using an unsafe implementation of the HostnameVerifier. And refer a link to Google Play Help Center article for details regarding to fixing and deadline of vulnerability.

Below is my code.

HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier(){ 
    public boolean verify(String arg0, SSLSession arg1) {
        return true;
}});

Anyone can explain with example about, what changes should I do to fix this warning?

Answer

Antimony picture Antimony · Dec 6, 2016 
HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier(){ 
    public boolean verify(String arg0, SSLSession arg1) {
        return true;
}});

This code effectively removes the protection of HTTPS from your connections. You need to delete it.

Disabling hostname verification allows anyone on the network to view and tamper with your network traffic by conducting a Man In The Middle Attack.

Related questions

Webview avoid security alert from google play upon implementation of onReceivedSslError

I have a link which will open in webview. The problem is it cannot be open until I override onReceivedSslError like this: @Override public void onReceivedSslError(WebView view, SslErrorHandler handler, SslError error) { handler.proceed(); } I am getting security alert from …

Read More
android Google Play Warning: SSL Error Handler Vulnerability

I use the gorbin/ASNE SDK in my app. I recently received an email from Google with the following subject : "Google Play Warning: SSL Error Handler Vulnerability". In this email, Google explains that my app has an ["unsafe implementation of …

Read More
SSL Warning from google play

Got warning from google play. How can i handle "SSL Error Handler Vulnerability" of unsafe implementation of the WebViewClient.onReceivedSslError handler. "Please address this vulnerability as soon as possible and increment the version number of the upgraded APK. To properly …

Read More