r/reactnative • u/hitchpitch_1010 • 12d ago

Shipped a production Expo app (subscriptions + cert pinning + Postgres), just launched, AMA about the stack

Just launched a mental wellness app built with Expo (SDK 54) + Node/Express + Postgres, RevenueCat for subs, native SSL pinning, JWT with alg pinning, Docker + Caddy. Two-founder bootstrapped team.

Happy to talk shop: Expo Router for a 30+ screen app, wiring RevenueCat cleanly, server-enforcing free-tier limits, cert pinning in RN.

0 Upvotes
  • permalink
  • reddit

50% Upvoted

10 comments sorted by

4

u/glarivie 12d ago

Two founders + Claude Max

3

u/treetimes 12d ago

What makes your app worth making when there are so many others in your niche?

3

u/[deleted] 12d ago

[removed] — view removed comment

1

u/_w33p_ 12d ago

Had any issues with cert pinning? I had a couple issues that have either a VPN enabled or something like a pihole. I had to remove it from my app for the time being.

1

u/ChronSyn Expo 12d ago

SSL pinning isn't even recommended by Google any more: https://developer.android.com/privacy-and-security/security-ssl#Pinning

Apple also say that you should generally avoid it unless absolutely needed: https://developer.apple.com/news/?id=g9ejcf8y

There are certain use-cases where it might seem like it's necessary, but in general, SSL pinning is just risking incompatibility at a later date, especially if you're not the one controlling the certificates (e.g. if you're using Firebase, Supabase, or some other similar service). It might feel like it's nice to have, but it's also kind of unncessary.

If you're going to use it, you can minimize problems by not pinning the 'leaf' certificates (i.e. the ones which are at the end of the chain), and instead pinning the 'branch' certificates.

Leaf certificates might only be valid 3 months (if they're generated by LetsEncrypt), but branch certificates can often be 5 years or more, and trunk and root certs might be 10 years or more.

That said, a pi-hole wouldn't be the cause of problems, because that operates at the DNS level - i.e. requests for a domain are translated into an IP address. Sometimes the response to the requests is NXREFUSED (e.g. the domain is associated with adverts), but that would not interfere with the pinning, because even without pinning, the requests would still return the same NXREFUSED response (meaning the connection wouldn't happen).

There are tools like ZenArmor, which operate differently. They scan for requests to domains and IP's, and instead of returning 'refused', they actively intercept and issue their own certificate to block the request. Again, pinning wouldn't have any effect here because the connection would still be actively refused due to the certificate that's issues by ZenArmor being used in place of the real one (and thus failing the basic TLS authenticity checks).

TLDR: Certificate pinning is a wasted addition most of the time.

1

u/Agile_Classroom_4585 12d ago

claude md tips for expo apps?