Titanium JIRA Archive
Titanium SDK/CLI (TIMOB)

[TIMOB-28214] Android: Remove dead "TiAuthenticator" Java code to avoid security warnings

GitHub Issuen/a
TypeImprovement
PriorityMedium
StatusClosed
ResolutionFixed
Resolution Date2020-10-30T14:51:02.000+0000
Affected Version/sn/a
Fix Version/sRelease 9.3.0
ComponentsAndroid
Labelsandroid, http, network, security
ReporterJoshua Quick
AssigneeJoshua Quick
Created2020-10-29T21:42:41.000+0000
Updated2020-11-10T11:32:27.000+0000

Description

*Summary:* Our [TiAuthenticator.java](https://github.com/appcelerator/titanium_mobile/blob/master/android/modules/network/src/java/ti/modules/titanium/network/TiAuthenticator.java) class is no longer used. Its usage was removed by ticket [TIMOB-24748] in Titanium 6.1.1. We should delete this Java class. *Note:* This class was used for HTTP "basic authentication", which involves adding a username/password into the URL. This is not secure. So, removing this class prevents it coming up in security scan software such as Veracode.

Comments

  1. Joshua Quick 2020-10-30

    PR (master): https://github.com/appcelerator/titanium_mobile/pull/12232
  2. Christopher Williams 2020-10-30

    Merged to master for 9.3.0 target
  3. Samir Mohammed 2020-11-03

    Closing tickets as unit tests pass. Improvement verified in SDK version 9.3.0.v20201103024935 Test and other information can be found at: https://github.com/appcelerator/titanium_mobile/pull/12232

JSON Source