Android Security Provider

@capacitor-community/security-provider

Check and update the Android Security Provider in a Capacitor app.

About

Capacitor plugin with a method to check and update the Android Security Provider.

Android relies on a security Provider to provide secure network communications. However, from time to time, vulnerabilities are found in the default security provider. To protect against these vulnerabilities, Google Play services provides a way to automatically update a device's security provider to protect against known exploits. By calling Google Play services methods, you can help ensure that your app is running on a device that has the latest updates to protect against known exploits.

For example, a vulnerability was discovered in OpenSSL (CVE-2014-0224) that can leave apps open to an on-path attack that decrypts secure traffic without either side knowing. Google Play services version 5.0 offers a fix, but apps must check that this fix is installed. By using the Google Play services methods, you can help ensure that your app is running on a device that's secured against that attack.

Install

npm install @capacitor-community/security-provider
npx cap sync

Usage

import { CapacitorSecurityProvider, SecurityProviderStatus } from '@capacitor-community/security-provider';
...
    const result = await CapacitorSecurityProvider.installIfNeeded();
    if (result.status !== SecurityProviderStatus.Success && result.status != SecurityProviderStatus.NotImplemented) {
        // Do not proceed. The Android Security Provider failed to verify / install.
    }

See Sample Capacitor 5 application that uses this plugin.

API

• installIfNeeded()
• Enums

installIfNeeded()

installIfNeeded() => Promise<{ status: SecurityProviderStatus; }>

Returns: Promise<{ status: SecurityProviderStatus; }>

---

Enums

SecurityProviderStatus

Members	Value	Description
Success	'Success'	This indicates that the provider was already up to date or was successfully updated
NotImplemented	'NotImplemented'	This will occur on iOS and Web as these platforms cannot call the Android Security Provider
GooglePlayServicesRepairableException	'GooglePlayServicesRepairableException'	Indicates that Google Play services is out of date, disabled, etc. If this is returned a native dialog will notify and prompt the user to update.
GooglePlayServicesNotAvailableException	'GooglePlayServicesNotAvailableException'	Indicates a non-recoverable error; the ProviderInstaller can't install an up-to-date Provider. You should abort running the application.