Project: titanium
Issue TIMOB-18129: Https Module does not throw exception on fail as expected
h3. Issue According to our documentation when the HTTPClient send() is called to do an https request and the authentication fails, a security exception will be thrown but instead customer receives a WARNING log on iOS and an ERROR log in Android to finish the call with the onError callback being fired. This is causing than when customer tries to catch the exception is not possible. {code} After the securityManager property is set, call the HTTPClient's open() and send() methods to initiate the HTTPS request. httpClient.open("GET", "https://yourorg.com"); httpClient.send(); If the authentication fails, a security exception is thrown. {code} h3. Log iOS {code} [INFO] httpClient Created. [WARN] Potential "Man-in-the-Middle" attack detected since host www.appcelerator.com does not hold the private key corresponding to the public key PublicKey: . [INFO] onerror() [INFO] {"type":"error","source":{"method":"GET","securityManager":{},"timeout":25000,"url":"https://www.appcelerator.com"},"code":-1012,"error":"The operation couldn’t be completed. (NSURLErrorDomain error -1012.)","success":false} {code} Android {code} [INFO] httpClient Created. [DEBUG] dalvikvm: GC_CONCURRENT freed 231K, 2% free 16219K/16524K, paused 4ms+0ms, total 8ms [ERROR] TiHttpClient: (TiHttpClient-1) [3000,3000] HTTP Error (javax.net.ssl.SSLHandshakeException): Leaf certificate could not be verified with provided public key [ERROR] TiHttpClient: javax.net.ssl.SSLHandshakeException: Leaf certificate could not be verified with provided public key [ERROR] TiHttpClient: com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:409) [ERROR] TiHttpClient: com.android.org.conscrypt.OpenSSLSocketImpl$SSLInputStream.(OpenSSLSocketImpl.java:661) [ERROR] TiHttpClient: com.android.org.conscrypt.OpenSSLSocketImpl.getInputStream(OpenSSLSocketImpl.java:632) [ERROR] TiHttpClient: org.apache.http.impl.io.SocketInputBuffer.(SocketInputBuffer.java:70) [ERROR] TiHttpClient: org.apache.http.impl.SocketHttpClientConnection.createSessionInputBuffer(SocketHttpClientConnection.java:83) [ERROR] TiHttpClient: org.apache.http.impl.conn.DefaultClientConnection.createSessionInputBuffer(DefaultClientConnection.java:170) [ERROR] TiHttpClient: org.apache.http.impl.SocketHttpClientConnection.bind(SocketHttpClientConnection.java:106) [ERROR] TiHttpClient: org.apache.http.impl.conn.DefaultClientConnection.openCompleted(DefaultClientConnection.java:129) [ERROR] TiHttpClient: org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:172) [ERROR] TiHttpClient: org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:164) [ERROR] TiHttpClient: org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:119) [ERROR] TiHttpClient: org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:360) [ERROR] TiHttpClient: org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:555) [ERROR] TiHttpClient: org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:653) [ERROR] TiHttpClient: org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:637) [ERROR] TiHttpClient: ti.modules.titanium.network.TiHTTPClient$ClientRunnable.run(TiHTTPClient.java:1328) [ERROR] TiHttpClient: java.lang.Thread.run(Thread.java:841) [ERROR] TiHttpClient: Caused by: java.security.cert.CertificateException: Leaf certificate could not be verified with provided public key [ERROR] TiHttpClient: appcelerator.https.PinningTrustManager.checkServerTrusted(PinningTrustManager.java:84) [ERROR] TiHttpClient: com.android.org.conscrypt.OpenSSLSocketImpl.verifyCertificateChain(OpenSSLSocketImpl.java:613) [ERROR] TiHttpClient: com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method) [ERROR] TiHttpClient: com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:405) [ERROR] TiHttpClient:	... 16 more [INFO] onerror() [INFO] {"code":-1,"source":{"autoRedirect":true,"status":0,"responseData":null,"connected":false,"readyState":1,"allResponseHeaders":"","responseText":"","username":null,"timeout":25000,"statusText":null,"autoEncodeUrl":true,"apiName":"Ti.Network.HTTPClient","validatesSecureCertificate":false,"location":"https://www.appcelerator.com","domain":null,"connectionType":"GET","responseXML":null,"bubbleParent":true,"password":null,"securityManager":{"bubbleParent":true,"apiName":"appcelerator.Https.PinningSecurityManager"},"_events":{"disposehandle":{}}},"error":"Leaf certificate could not be verified with provided public key","success":false} {code} h3. Test code {code} var win = Ti.UI.createWindow(); var but = Ti.UI.createButton({	title:"click" }); but.addEventListener('click',doClick); var https = require("appcelerator.https"); function doClick(e) {	var securityManager = https.createX509CertificatePinningSecurityManager([{	url: 'https://www.appcelerator.com',	serverCertificate: 'google.com.der'	}]); var httpClient = Ti.Network.createHTTPClient({	timeout : 25000,	securityManager: securityManager	});	httpClient.onload = function(e) {	Ti.API.info('onload()');	};	httpClient.onerror = function(e) {	Ti.API.info('onerror()');	};	Ti.API.info("httpClient Created.");	try {	httpClient.open('GET', 'https://www.appcelerator.com');	httpClient.send();	} catch (exception) {	Ti.API.info('SecurityException occurred');	} } win.add(but); win.open(); {code} h3. Steps to repro 1. run test case ( demo.zip) 2. click on the button Expected Result A security exception is thrown and handled by the catch code Actual Result No exception is thrown
Story points: 8