[Android Auto] Investigate how we need to handle trusted hosts

Open

#27 opened on Aug 11, 2021 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Documentation
Clarity: Needs clarification
Activity status: Stale
Tech stack: android, kotlin
Domain: mobile, security

Research direction

Start with MainCarAppService and the linked AndroidX HostValidator documentation, focusing on the current ALLOW_ALL_HOSTS_VALIDATOR configuration and the commented allow-list alternative. Document how trusted hosts should be handled for production and share the findings and recommendation in the issue.

Written by the indexing model from the issue text.

Description

jira-sync-complete

@kmadsen commented on Thu May 27 2021

The car library has a HostValidator

Which essentially makes the 1tap app a trusted host with the head unit. You can find where this is in the MainCarAppService. I don't fully understand either, so this ticket is to figure it out and share your findings.

class MainCarAppService : CarAppService() {
    override fun createHostValidator(): HostValidator {
        return HostValidator.ALLOW_ALL_HOSTS_VALIDATOR
        // TODO limit hosts for production
        //    https://github.com/mapbox/1tap-android/issues/988
//        return HostValidator.Builder(this)
//                .addAllowedHosts(R.array.android_auto_allow_list)
//                .build()
    }

    override fun onCreateSession(): Session {
        return MainCarSession()
    }
}

Dominant language: Kotlin
Stars: 65
Forks: 56
Avg merge: 1d 4h
Merged PRs (30d): 2

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.