{"action":"created","issue":{"url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/2619","labels_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/2619/labels{/name}","comments_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/2619/comments","events_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/2619/events","html_url":"https://github.com/AFNetworking/AFNetworking/issues/2619","id":64784951,"number":2619,"title":"AFSSLPinningModeNone vulnerable to man-in-the-middle attacks","user":{"login":"ivanlei","id":1002798,"avatar_url":"https://avatars.githubusercontent.com/u/1002798?v=3","gravatar_id":"","url":"https://api.github.com/users/ivanlei","html_url":"https://github.com/ivanlei","followers_url":"https://api.github.com/users/ivanlei/followers","following_url":"https://api.github.com/users/ivanlei/following{/other_user}","gists_url":"https://api.github.com/users/ivanlei/gists{/gist_id}","starred_url":"https://api.github.com/users/ivanlei/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ivanlei/subscriptions","organizations_url":"https://api.github.com/users/ivanlei/orgs","repos_url":"https://api.github.com/users/ivanlei/repos","events_url":"https://api.github.com/users/ivanlei/events{/privacy}","received_events_url":"https://api.github.com/users/ivanlei/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-03-27T15:31:16Z","updated_at":"2015-05-12T18:18:48Z","closed_at":"2015-03-27T15:39:48Z","body":"### AFSSLPinningModeNone vulnerable to man-in-the-middle attacks\r\n\r\n[`AFSecurityPolicy.validatesDomainName`](https://github.com/AFNetworking/AFNetworking/blob/master/AFNetworking/AFSecurityPolicy.h#L62) should default to `YES` in all cases.\r\n\r\nAt a high level HTTPS is meant to provide both an encryption and authentication. By default, AFNetworking sets `AFSSLPinningModeNone` which as a side effect disables validation of CN name in the server certificate. This disables authentication of the server and leaves sessions vulnerable to man-in-the-middle attacks.\r\n\r\nThis may be considered a breaking change but would make AFNetworking *secure by default*.\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/comments/101373324","html_url":"https://github.com/AFNetworking/AFNetworking/issues/2619#issuecomment-101373324","issue_url":"https://api.github.com/repos/AFNetworking/AFNetworking/issues/2619","id":101373324,"user":{"login":"natecode","id":1581257,"avatar_url":"https://avatars.githubusercontent.com/u/1581257?v=3","gravatar_id":"","url":"https://api.github.com/users/natecode","html_url":"https://github.com/natecode","followers_url":"https://api.github.com/users/natecode/followers","following_url":"https://api.github.com/users/natecode/following{/other_user}","gists_url":"https://api.github.com/users/natecode/gists{/gist_id}","starred_url":"https://api.github.com/users/natecode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/natecode/subscriptions","organizations_url":"https://api.github.com/users/natecode/orgs","repos_url":"https://api.github.com/users/natecode/repos","events_url":"https://api.github.com/users/natecode/events{/privacy}","received_events_url":"https://api.github.com/users/natecode/received_events","type":"User","site_admin":false},"created_at":"2015-05-12T18:18:48Z","updated_at":"2015-05-12T18:18:48Z","body":"#2690 has been closed, and there is no currently known issue with 1.2.0 - 1.3.4. Apologies for the broken test.\r\n\r\nI do think it would be worth mentioning which released versions of the 2.x series (besides 2.5.0 - 2.5.2) are affected by this issue where `AFSecurityPolicy.validatesDomainName` defaults to `NO`."}}