your app is using unsafe implementation of hostname verifier

Question

When I am uploading my app to playstore it shows the warning

"your app is using unsafe implementation of hostname verifier"

How to solve this problem.

 SSLContext sc = SSLContext.getInstance("SSL"); sc.init(null, trustAllCerts, new SecureRandom());
 HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFa‌ctory());
 HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {

 @Override public boolean verify(String arg0, SSLSession arg1) {

       return true; 
   } 
});

Java class name must be mention in there. Please post that as well. — Nilesh Deokar, Oct 05 '17 at 07:13
SSLContext sc = SSLContext.getInstance("SSL"); sc.init(null, trustAllCerts, new SecureRandom()); HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() { @Override public boolean verify(String arg0, SSLSession arg1) { return true; } }); — sailaja varma, Oct 05 '17 at 07:17
Possible duplicate of [Google Play Security Alert - Your app is using an unsafe implementation of the HostnameVerifier](https://stackoverflow.com/questions/40928435/google-play-security-alert-your-app-is-using-an-unsafe-implementation-of-the-h) — Nilesh Deokar, Oct 05 '17 at 07:21

score 1 · Answer 1 · edited Feb 23 '20 at 18:42

You are using an unsafe implementation of the HostnameVerifier interface here

HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() { 
    @Override public boolean verify(String arg0, SSLSession arg1) { 
        return true; 
    } 
});

Google is pretty strict about it these days. You can check this link for more information.

Instead of true always return false whenever the hostname of the server does not meet your expectations.

Instead use

@Override
public boolean verify(String arg0, SSLSession arg1) { 
    HostnameVerifier hv = HttpsURLConnection.getDefaultHostnameVerifier();
    return hv.verify("your_domain.com", arg1);
}

your app is using unsafe implementation of hostname verifier

1 Answers1