What is Network Security and SSL Pinning?

React Native Practical - Interview Questions and Answers

Network Security & SSL Pinning in React Native

1. What is Network Security?

Network security is the practice of protecting data during transmission between a mobile app and a server. It prevents data breaches, hacking, and man-in-the-middle (MITM) attacks.

Key Components of Network Security

* Encryption: Uses protocols like TLS (Transport Layer Security) to encrypt data.
* Authentication: Verifies user identity (e.g., JWT tokens, OAuth).
* SSL/TLS Certificates: Ensure the server is legitimate and secure.
* Firewalls & VPNs: Restrict unauthorized access.

2. What is SSL Pinning?

SSL Pinning is an advanced security technique used to prevent MITM attacks by hardcoding the server’s SSL certificate inside the mobile app.

Why Use SSL Pinning?

* Prevents attackers from intercepting HTTPS traffic
* Stops fake certificates from being accepted
* Ensures communication with the intended server

* Without SSL Pinning:

Hackers can intercept HTTPS traffic, fake a server’s certificate, and steal sensitive data (e.g., API keys, user credentials).

* With SSL Pinning:

Even if an attacker tries to use a fake certificate, the app will reject it!

3. How to Implement SSL Pinning in React Native

To implement SSL Pinning in a React Native app, use the react-native-ssl-pinning library.

* Installation

npm install react-native-ssl-pinning

yarn add react-native-ssl-pinning

* Example Usage (API Request with SSL Pinning)

import { fetch } from 'react-native-ssl-pinning';

fetch('https://api.example.com/data', {
  method: 'GET',
  headers: { Accept: 'application/json' },
  sslPinning: {
    certs: ['my-cert'], // Reference to pinned certificate
  },
})
  .then(response => response.json())
  .then(data => console.log('Secure data:', data))
  .catch(error => console.error('SSL Pinning failed:', error));

* Steps to Get SSL Certificate:

Get the certificate using this command:

openssl s_client -connect api.example.com:443 -showcerts

Copy the PEM certificate content and save it as .cer file in your project.
Add the certificate to your app's assets folder.

4. Drawbacks of SSL Pinning

* App Updates Required – If the server updates its SSL certificate, you must release a new app update.
* More Maintenance – Requires managing certificate expiration.
* Device-Specific Bypasses – Advanced attackers can still bypass SSL pinning using rooted devices.

Best Practices for Network Security

* Use TLS 1.2+ for secure data transmission.
* Implement SSL Pinning to prevent MITM attacks.
* Use OAuth, JWT, or API Keys for authentication.
* Never store sensitive data in AsyncStorage (use SecureStore for Expo).
* Use network monitoring tools like Charles Proxy for security testing.

Summary

Feature	SSL Pinning	General Network Security
Prevents MITM Attacks	Yes	Limited
Requires Manual Updates	Yes	No
Works with HTTPS?	Yes	Yes
Easy to Implement?	Medium	Yes