This question already has an answer here:
I have a mobile app that queries various 3rd party API/sites (these are https links). I have a concern that SSL proxies (e.g. Charles) can be used to intercept the traffic - man in the middle.
Are there any instances that charles would not ables to read the traffic?
It seems crazy to me that something basic like SSL proxy can undermine a well used technology - TLS.
What are my options to mitigate against a SSL proxy decrypting the traffic and possibly seeing sensitive information?
Would Public key pinning be a possible mitigation ? Anything else?