TLS 1.0 vs 1.2 error (Am I missing something?) #567
Comments
|
The service point manager stuff is already set if you are using the 4.5 version and not the PCL - it's probably your server. I'd search for setting your server up to use TLS1.2 - your findings and results are very welcome here for others to find! |
|
And thanks much for the kind words :) |
|
You're most certainly welcome and thanks for the quick reply! My confusion may very well lay in your response. What do you mean by server? The code referenced is in my Xamarin app itself. The only server involved at this point is Stripe's processing the data. I literally did nothing but install the Nugent in my Xamarin.Android project and call the code. Maybe that means Xamarin handles those calls natively with TLS1.0 regardless of the versions I'm using? Any guidance would be appreciated. |
|
OH, Xamarin ... about that.... read the bottom here[1], where I start talking about Xamarin. Basically, Mono's implementation only supports 1.0 right now. You can read me whining about it to them here[2]. Long story short - nothing can be done right now. I hope to have a better solution soon, as all the PCL users will hit the same wall. |
|
I'm with you now. Thanks for clarifying that. I'll see what I can come up with. If I do come up with an alternate solution, I'll be sure to reference it here. |
|
Just wanted to add this documentation link - Xamarins compiler has options on which implementation of TLS it uses (and subsequently, which TLS version it uses) https://developer.xamarin.com/guides/cross-platform/transport-layer-security/ |
|
Thank you @makerofthings7. I'll work on it this weekend and try the environment route. Will let you guys know the results! |
|
@jaymedavis and @makerofthings7, it was a heavy weight fight but I got it to work! Here's my findings. Hope this helps. Notes:
|
|
Thanks for the research @rastapapolis, and thanks @makerofthings7 for the links. I did have ModernHttpHandler in Stripe.net for a long time, until users started contacting me about it not working. I have not checked out how @paulcbetts implemented his handlers, but if mono-tls doesn't come up with a solution sometime soon, I might take his advice and offer an injection point (probably StripeConfiguration.HttpHandler) for users. I am just hesitant about this because I would prefer the library keep with no configuration. This could just be my misunderstanding on how this works. I would love for ModernHttpClient to just work with all implementations so it is just the handler again in Stripe.net. It would help to find the original issue where the user had to have ModernHttpClient removed. If we could fix that, we could submit a PR to Paul to fix this - then viola, no configuration. It's the easiest library in the world to use, so it would be great if it just worked everywhere. :) |
|
Im also surprised Xamarin's documentation sent you down a path for something that didn't work. In the meantime @rastapapolis, you should be able to tell Stripe to turn this off for you and point them to this issue. It's certainly not your fault this problem isn't solved. Let me know if you would like to try this, I might be able to help. |
|
I agree with your assessment @jaymedavis. Please let me know if you go back down the Modern route as your library will save me work moving forward when I need to use other stripe features. I'd be interested to know which use case didn't work with modern. I've had no problems since using it. I've never submitted to Xamarin. Can you point me to a link so I can tell them about it? Thx! |
|
Send me a concise write up and lmk your email address. I have enterprise licensing so I can email the developers vs stack overflow On Sun, Aug 28, 2016 at 4:09 PM -0400, "rastapapolis" notifications@github.com wrote: I agree with your assessment @jaymedavis. Please let me know if you go back down the Modern route as your library will save me work moving forward when I need to use other stripe features. I'd be interested to know which use case didn't work with modern. I've had no problems since using it. I've never submitted to Xamarin. Can you point me to a link so I can tell them about it? Thx! — |
|
@makerofthings7 Here's the details: Platforms/Versions:Microsoft Visual Studio v. 14.0.25123.00 Update 2 What I did:Created EnvironmentVariables.txt file and made sure the BuildAction is AndroidEnvironment. The entry in that file is: XA_HTTP_CLIENT_HANDLER_TYPE=Xamarin.Android.Net.AndroidClientHandler Tried using Stripe.net plug-in and also HttpClient constructing it as: new HttpClient(). I also tried constructing it like: new HttpClient(new Xamarin.Android.Net.AndroidClientHandler()) Here's the Visual Studio Output:08-29 03:35:19.073 D/Mono ( 2960): Assembly Ref addref myPT.Droid[0xad97ad80] -> System.Net.Http[0x9c567360]: 3 Stacktrace:{Java.Net.ProtocolException: unexpected end of stream Screenshot:
|
|
Nice write-up @rastapapolis. If you have their ear, @makerofthings7, I would love to know what the status of mono-tls[1] is. This would solve our problems. |
|
You got it @jaymedavis ! |
|
Hey guys, just wanted to throw in that I've also run into this exact problem as well re: TLS issuse on Android. Just like @rastapapolis I attempted to solve the issue by including the Environment variable of XA_HTTP_CLIENT_HANDLER_TYPE=Xamarin.Android.Net.AndroidClientHandler with no dice. What I ended up doing was modifying the Requestor class to accept an injected HttpMessageHandler so that I could get Stripe to accept my requests. Like you said @jaymedavis it would be preferable to not have to do any configuration, but if you want I can open a PR for what I've done with injecting the HttpMessageHandler. |
|
Thx for the info @duckwaffle! As a result of your solution, were you able to use the stripe.net library? If so, can you post some code so I can try it plz? Unfortunately as part of my solution, I'm not using the library but I'd love to. |
|
No worries @rastapapolis . If you want to have a look at what I did to modify the Stripe.net library, you can check out duckwaffle@286d1bf . Using those modifications, you can put the following code anywhere in your application before calling Stripe services (probably in MainActivity.OnCreated or something like that):
|
|
Nice! Thanks for sharing @duckwaffle. Did you create a package or just include the source for the library within your workspace? I like that solution but I see the configuration concerns you and @jaymedavis have now. Here's a thought. Would it be possible to tell at compile time whether it's Android and just set the handler? That would take care of the config issue. |
|
Hope you don't mind me doing much more than acting as a passive middleman, but this is Xamarin's response (2 parts). Feel free to take this offline if you want at my name at Gmail, and I can loop you into the reply Hey, Ah okay. Well TLS 1.2 is in a transition period right now. As you have stated, HTTPClient based calls are compatible with TLS 1.2 via the native handler. However, there are some caveats to this configuration. We are working on adding full TLS 1.2 support, however that is still being planned. To fully understand the situation and hopefully get a solution, I need to know where you are with the steps you have taken. It seems that the Stripe.net does not allow you to pass in an HTTPClient, and it will use the default with no overloads (https://github.com/jaymedavis/stripe.net/blob/6ae20e088d5ca2d74776f092b29438dd4bbe8620/src/Stripe/Infrastructure/Requestor.cs#L18). Are you using the binary distribution of Stripe.net, or are you adding the source to the project and building from there? If you are using the NuGet package, then adding the environment variable will not, in my understanding, change much. However, if you are building Stripe.net with your project, then the changes should take effect and the native handler should be being used. Based upon the native stacktrace: at com.android.okhttp.internal.http.HttpConnection$FixedLengthSink.close(HttpConnection.java:314) It seems you are calling the native handler. With all of this in mind, it seems that there is some bug between the native handler, and Stripe.net. Are you able to provide a test project to debug with? I can work on creating one as well, but as of right now I do not have a Stripe account to test with :) Thanks! ------ Previous message ---- Hope you are well! Just to get a better understanding of what is happening, and what the desires are. You are attempting to use the Stripe.Net binding on an Android project. Stripe is about to disable TLS 1.0, so you are attempting to use the native handler in HTTPClient on Android. It is at this point that you get the above error. Is that all correct? |
|
@makerofthings7, thank you and I absolutely don't mind you being a passive middleman. It's definitely a Xamarin bug as I get the same error without using the stripe.net package. I think the issue may be in their statement, "We are working on adding full TLS 1.2 support, however that is still being planned." My guess is, what we're hitting is a direct result of it not being full featured TLS 1.2. Please point them to this post if possible. As for a test project they can debug, they can literally take the snippet of code below verbatim, create a stripe account so they can replace the "test" keys and try it. They'll get the error and as you can see, stripe.net isn't implemented as part of the solution. Replacing Xamarin.Android.Net.AndroidClientHandler() with NativeMessageHandler() which is provided by "using ModernHttpClient" does work however. So there's something going on with their handler.
|
|
Thanks @makerofthings7 for getting this information. It sounds like for now, the best bet is just to let users pass in their own handler. I will add this before the next release. I viewed your code @duckwaffle - it's easy enough to add in - thanks. I don't think this is ideal at all, but I don't really see another way around it. |
|
For the Xamarin stuff, it seems that the Stripe documentation recommends that we don't make actual charges from the Android/iOS code as that requires that we put our private key in the deployed (to iOS and Android) code. However, the first code sample in this thread seems to go against that thinking, and I'm assuming somewhere in that code the developer had to have their private Stripe key in the Android/iOS code.. So, am I missing something there, or are people putting their private Stripe key directly in the Android/iOS Xamarin code? |
|
If that's your concern you could always store the key in a DB and retrieve
it via a secure connection. For testing purposes I just had it in the code
but admittedly I never published that app.
…On May 18, 2017 12:44 AM, "kpronz" ***@***.***> wrote:
For the Xamarin stuff, it seems that the Stripe documentation recommends
that we don't make actual charges from the Android/iOS code as that
requires that we put our private key in the deployed (to iOS and Android)
code. However, the first code sample in this thread seems to go against
that thinking, and I'm assuming somewhere in that code the developer had to
have their private Stripe key in the Android/iOS code.. So, am I missing
something there, or are people putting their private Stripe key directly in
the Android/iOS Xamarin code?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<https://github.com/jaymedavis/stripe.net/issues/567#issuecomment-302299081>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/AUK2ujZpVISdtPBhiBLJTD01Odvr8zNBks5r68yegaJpZM4JpMpN>
.
|
Jayme,
How are you? I have to start off by giving you props. Great library man! Saved me tons of time. Thank you! :)
I've searched your tickets and saw that the TLS 1.0 vs 1.2 has been resolved but I'm still getting the error for some reason. Below are the versions of everything I'm running. Could there be something else or a critical step I'm missing? Appreciate your time and sorry about bring this up once again.
Code:
`var token = await StripeClient.CreateToken(c, Stripe.StripeClient.DefaultPublishableKey);
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls;
var myCharge = new StripeChargeCreateOptions();
var session = Element.session;
myCharge.Amount = 6000;
myCharge.Currency = "usd";
myCharge.Description = "Services for guest";
myCharge.SourceTokenOrExistingSourceId = token.Id;
myCharge.Capture = true;
var chargeService = new StripeChargeService();
StripeCharge stripeCharge = chargeService.Create(myCharge);`
Versions:
.NET Framework 4.6.01038
Stripe.NET v6.4.0
Xamarin Forms v2.3.1.114
Error:
The text was updated successfully, but these errors were encountered: