Hi there, I’m having a lot of trouble trying to make https post requests to an API work in production builds of the app.
The app works perfectly in the debug build.
I had to use cordova-plugin-advanced-http and change my code so I could do this.http.setSSLCertMode('nocheck'); until I can get the final certificate so I can do SSL Pinning.
This is how I changed my code.
Angular HTTP:
postData(data, object, type) {
return new Promise((resolve, reject) => {
var headers = new Headers();
headers.append('Access-Control-Allow-Origin' , '*');
headers.append('Access-Control-Allow-Methods', 'POST, GET, OPTIONS, PUT');
headers.append('Accept','application/json');
headers.append('content-type','application/json');
let options = new RequestOptions({headers:headers});
this.http.post(url, data, options)
.subscribe(res => {
resolve(res.json());
}, (err) => {
reject(err);
});
});
}
to
Cordova/Ionic Native HTTP:
postData(data, object, type) {
return new Promise((resolve, reject) => {
//Don't check SSL Certificate
this.http.setSSLCertMode('nocheck');
this.http.setHeader('*', 'Access-Control-Allow-Origin' , '*');
this.http.setHeader('*', 'Access-Control-Allow-Methods', 'POST, GET, OPTIONS, PUT');
this.http.setHeader('*', 'Accept','application/json');
this.http.setHeader('*', 'content-type','application/json');
//Important to set the data serializer or the request gets rejected
this.http.setDataSerializer('json');
this.http.post(url, data, {}).then(res =>{
resolve(JSON.parse(res.data));
})
.catch(err =>{
reject(err);
});
});
}
This allowed the HTTPS POST requests to work in the release build
However I have the same problem with a Let’s Encrypt certificate and this solution seems only not to check the certificate.
It is just a patch not a solution, I mean the problem perhaps is on the certificate.
Or mai I wrong?
You are correct, this solution was just a workaround until I could get a final CA certificate.
The plugin has also changed since this answer was written, the new code for me would be:
postData(data, object, type) {
return new Promise((resolve, reject) => {
// disable SSL cert checking, only meant for testing purposes, do NOT use in production!
this.http.setServerTrustMode('nocheck', function () {
console.log('success!');
}, function () {
console.log('error :(');
});
this.http.setHeader('*', 'Access-Control-Allow-Origin', '*');
this.http.setHeader('*', 'Access-Control-Allow-Methods', 'POST, GET, OPTIONS, PUT');
this.http.setHeader('*', 'Accept', 'application/json');
this.http.setHeader('*', 'content-type', 'application/json');
//Important to set the data serializer or the request gets rejected
this.http.setDataSerializer('json');
this.http.post(url, data, {}).then(res => {
resolve(JSON.parse(res.data));
})
.catch(err => {
reject(err);
});
});
}
If you wanted to allow SSL Pinning, which could solve all the problems related to SSL provided you don’t have a self-signed one, the code would be this instead:
You have to include your certificate in www/certificates. The certificate must have a .cer extension and it must be DER encoded. If it’s PEM encoded you can use this Stack Overflow Answer to convert it to DER.
I have a similar problem to this but only on Android 9.0.
It’s working fine in ionic cordova run android --device . but not on ionic cordova build android --prod --release . And the server already running under SSL. https://www.ssllabs.com/ssltest/analyze.html?d=apps.uib.ac.id
