iosproxycharles-proxy

Cannot debug Vine and Twitter API via Charles debug proxy while Facebook, Flickr and any other API can be

I am trying to debug Vine API using Charles debug proxy. I have an IOS version of Vine app running in my device and I have set WiFi proxy.

I could debug API calls from all other applications by enabling ssl proxying. But SSL proxying is not working for Vine (api.vine.com). I tried Twitter, Facebook and Flickr apps. I could debug Facebook and Flickr APIs and could see JSON response but for Twitter this fails.

As Vine is owned by Twitter, my doubt is if Twitter has implemented some security in their APIs or changed some protocols to ensure that APIs cannot be debugged. If that is the case why Facebook has not implemented the same? Their APIs can be easily debugged.

Please find screenshots attached.

Vine API

Vine API cannot be read by proxy. API succeeds and data is shown in app

Flickr API

Flickr API

Facebook API

Facebook API

Twitter API

Twitter API

UPDATE:Jul 22, 2015

It seems that Twitter is using SSL pinning.

Solution

  • At last I found the reason. Twitter is using SSL pinning in their app to secure their APIs from man in the middle attack. There is a hint about this in their API documentation

    More information about pinning can be found here.