SSL Pinning in swift and authentication challenge
I am trying to implement SSL pinning and I did, using the didReceiveAuthentication Challenge. I do have a question, however, is that the description of this function
https://developer.apple.com/documentation/webkit/wknavigationdelegate/1455638-webview?language=objc
and so are the URLSession Version of it, both mentioned that only when the challenge is received. My worry is that, would there be website that doesn't ask for client certificate at all? If that is the case, how am I suppose to do SSL pinning then?
swift ssl-certificate wkwebview
asked Jan 3 at 17:07
AnnaAnna
136213
add a comment |
I am trying to implement SSL pinning and I did, using the didReceiveAuthentication Challenge. I do have a question, however, is that the description of this function
https://developer.apple.com/documentation/webkit/wknavigationdelegate/1455638-webview?language=objc
and so are the URLSession Version of it, both mentioned that only when the challenge is received. My worry is that, would there be website that doesn't ask for client certificate at all? If that is the case, how am I suppose to do SSL pinning then?
swift ssl-certificate wkwebview
asked Jan 3 at 17:07
AnnaAnna
136213
add a comment |
I am trying to implement SSL pinning and I did, using the didReceiveAuthentication Challenge. I do have a question, however, is that the description of this function
https://developer.apple.com/documentation/webkit/wknavigationdelegate/1455638-webview?language=objc
and so are the URLSession Version of it, both mentioned that only when the challenge is received. My worry is that, would there be website that doesn't ask for client certificate at all? If that is the case, how am I suppose to do SSL pinning then?
swift ssl-certificate wkwebview
asked Jan 3 at 17:07
AnnaAnna
136213
I am trying to implement SSL pinning and I did, using the didReceiveAuthentication Challenge. I do have a question, however, is that the description of this function
https://developer.apple.com/documentation/webkit/wknavigationdelegate/1455638-webview?language=objc
and so are the URLSession Version of it, both mentioned that only when the challenge is received. My worry is that, would there be website that doesn't ask for client certificate at all? If that is the case, how am I suppose to do SSL pinning then?
swift ssl-certificate wkwebview
swift ssl-certificate wkwebview
asked Jan 3 at 17:07
AnnaAnna
136213
asked Jan 3 at 17:07
AnnaAnna
136213
asked Jan 3 at 17:07
AnnaAnna
136213
asked Jan 3 at 17:07
AnnaAnna
136213
asked Jan 3 at 17:07
AnnaAnna
136213
136213
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Client-side certificate pinning has nothing to do with client certificates. didReceiveAuthenticationChallenge: is called in response to receiving the server's certificate as well. In that case it's called with the protectionSpace.authenticationMethod set to NSURLAuthenticationMethodServerTrust. If the server requests a client certificate, it'll be called again with ...ClientCertificate. If Basic Auth is required, it'll be called again with ...HTTPBasic and so on.
answered Jan 3 at 18:28
Rob NapierRob Napier
206k28304433
Ah so basically for any https connection, didReceiveChallenge will be called because it has a certificate?
– Anna
Jan 3 at 19:40
That's correct. That's why it's important to check the authenticationMethod when implementing this callback.
– Rob Napier
Jan 3 at 20:05
add a comment |
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54026760%2fssl-pinning-in-swift-and-authentication-challenge%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Client-side certificate pinning has nothing to do with client certificates. didReceiveAuthenticationChallenge: is called in response to receiving the server's certificate as well. In that case it's called with the protectionSpace.authenticationMethod set to NSURLAuthenticationMethodServerTrust. If the server requests a client certificate, it'll be called again with ...ClientCertificate. If Basic Auth is required, it'll be called again with ...HTTPBasic and so on.
answered Jan 3 at 18:28
Rob NapierRob Napier
206k28304433
Ah so basically for any https connection, didReceiveChallenge will be called because it has a certificate?
– Anna
Jan 3 at 19:40
That's correct. That's why it's important to check the authenticationMethod when implementing this callback.
– Rob Napier
Jan 3 at 20:05
add a comment |
Client-side certificate pinning has nothing to do with client certificates. didReceiveAuthenticationChallenge: is called in response to receiving the server's certificate as well. In that case it's called with the protectionSpace.authenticationMethod set to NSURLAuthenticationMethodServerTrust. If the server requests a client certificate, it'll be called again with ...ClientCertificate. If Basic Auth is required, it'll be called again with ...HTTPBasic and so on.
answered Jan 3 at 18:28
Rob NapierRob Napier
206k28304433
Ah so basically for any https connection, didReceiveChallenge will be called because it has a certificate?
– Anna
Jan 3 at 19:40
That's correct. That's why it's important to check the authenticationMethod when implementing this callback.
– Rob Napier
Jan 3 at 20:05
add a comment |
Client-side certificate pinning has nothing to do with client certificates. didReceiveAuthenticationChallenge: is called in response to receiving the server's certificate as well. In that case it's called with the protectionSpace.authenticationMethod set to NSURLAuthenticationMethodServerTrust. If the server requests a client certificate, it'll be called again with ...ClientCertificate. If Basic Auth is required, it'll be called again with ...HTTPBasic and so on.
answered Jan 3 at 18:28
Rob NapierRob Napier
206k28304433
Client-side certificate pinning has nothing to do with client certificates. didReceiveAuthenticationChallenge: is called in response to receiving the server's certificate as well. In that case it's called with the protectionSpace.authenticationMethod set to NSURLAuthenticationMethodServerTrust. If the server requests a client certificate, it'll be called again with ...ClientCertificate. If Basic Auth is required, it'll be called again with ...HTTPBasic and so on.
answered Jan 3 at 18:28
Rob NapierRob Napier
206k28304433
answered Jan 3 at 18:28
Rob NapierRob Napier
206k28304433
answered Jan 3 at 18:28
Rob NapierRob Napier
206k28304433
answered Jan 3 at 18:28
Rob NapierRob Napier
206k28304433
206k28304433
Ah so basically for any https connection, didReceiveChallenge will be called because it has a certificate?
– Anna
Jan 3 at 19:40
That's correct. That's why it's important to check the authenticationMethod when implementing this callback.
– Rob Napier
Jan 3 at 20:05
add a comment |
Ah so basically for any https connection, didReceiveChallenge will be called because it has a certificate?
– Anna
Jan 3 at 19:40
That's correct. That's why it's important to check the authenticationMethod when implementing this callback.
– Rob Napier
Jan 3 at 20:05
Ah so basically for any https connection, didReceiveChallenge will be called because it has a certificate?
– Anna
Jan 3 at 19:40
Ah so basically for any https connection, didReceiveChallenge will be called because it has a certificate?
– Anna
Jan 3 at 19:40
That's correct. That's why it's important to check the authenticationMethod when implementing this callback.
– Rob Napier
Jan 3 at 20:05
That's correct. That's why it's important to check the authenticationMethod when implementing this callback.
– Rob Napier
Jan 3 at 20:05
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54026760%2fssl-pinning-in-swift-and-authentication-challenge%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
