2

My question is what retry logic does Google Safetynet have built-in, and what retry logic should be build in the application? What is the best-practice for building the application level logic?

I use Safetynet Attestation in Android application and web backend service. Safetynet is used to validate that data is originating from our Android application installed in a valid Android device and that the message is not tampered. The basic code used is from Safetynet documentation example

I am having issues designing the retry logic for getting safetynet attestation in the device application in cases when network connectivity is not temporarily available, or otherwise Google Safetynet API is not accessible for a period of time.

Safetynet classes are based on GoogleApi class. Documentation for GoogleApi says that there is already some automatic time-out/reconnect logic.

  • Automatically timed-out and reconnected when necessary

What logic is automatically built-in to the Safetynet, and what logic needs to be build by application developers? For example what is the time-out for requests ("automatically timed-out") and can it be adjusted? How many retries does it do and with what retry strategy ("reconnected when necessary")?

Veikko
  • 3,372
  • 2
  • 21
  • 31

1 Answers1

3

As far as I know, the SafetyNet api only has listeners/callbacks for Success and Failure results for each request, it does not have built-in retry logic. You can check the errors coming on OnFailureListener through their StatusCode (check for SafetyNetStatusCodes) and handle them with you own retry logic.

davisjp
  • 730
  • 1
  • 11
  • 24
  • Do you know how long does the Android GoogleApi class take to return to OnFailureListener if the safetynet api is not available? It seems to wait quite long. Have you found any more info to what is the meaning of "Automatically timed-out and reconnected when necessary" -feature in the docs? – Veikko Apr 09 '19 at 09:43
  • I think you might be looking at an older version of the API, on the new one you make the request directly from the SafetyNet client, not from the Google Api. Have a look at the docs here: https://developer.android.com/training/safetynet/attestation.html – davisjp Apr 09 '19 at 12:09