zoukankan      html  css  js  c++  java
  • Has anybody found a way to load HTTPS pages with an invalid server certificate using UIWebView?

    If a user attempts to load a https web page in Mobile Safari and the server's certificate validation check fails (its expired, revoked, self-signed etc.) then the user is presented is presented with a warning message and asked if they want to continue or not.

    Similarly NSURLConnection offers the ability for the implementator to decide firstly how to check the certificate and then decide how to proceed if it fails, so in this situation too it would be possible to display a warning to the user and offer them the opportunity to continue loading the page or not.

    However it seems when loading a https page in UIWebView that fails a certificate check the behaviour is just to fail to load the page - didFailLoadWithError: gets called with kCFURLErrorServerCertificateUntrusted however nothing gets displayed to the user.

    This is inconsistent - surely the UIWebView behaviour should behave in a similar way to Safari to be consistent within iPhone itself? Its also a daft that NSURLConnection allows total flexibility with this yet NSURLRequest:setAllowsAnyHTTPSCertificate is private.

    Is there anyway to implement behaviour which is consistent with Safari, can this default behavior be customized in a similar way to NSURLConnection allows?

    Cheers

    P.S. Please refrain from getting into patronizing side discussions about why would anybody want to do this, thank you very much.

    I found out how to do this:

    1) When the page is loaded it will fail, thus add something like the following to didFailLoadWithError:

    - (void)webView:(UIWebView *)webView didFailLoadWithError:(NSError *)error
        if ([error.domain isEqualToString: NSURLErrorDomain])
        {
            if (error.code == kCFURLErrorServerCertificateHasBadDate        ||
                error.code == kCFURLErrorServerCertificateUntrusted         ||
                error.code == kCFURLErrorServerCertificateHasUnknownRoot    ||
                error.code == kCFURLErrorServerCertificateNotYetValid)
            {
            display dialog to user telling them what happened and if they want to proceed

    2) If the user wants to load the page then you need to connect using an NSURLConnection:

    NSURLRequest *requestObj = [NSURLRequest requestWithURL:self.currentURL     cachePolicy:NSURLRequestReturnCacheDataElseLoad timeoutInterval:10.0];
    self.loadingUnvalidatedHTTPSPage = YES;
    [self.webView loadRequest:requestObj];

    3) Then make this change to shouldStartLoadWithRequest

    - (BOOL)webView:(UIWebView *)webView shouldStartLoadWithRequest:(NSURLRequest *)request navigationType:(UIWebViewNavigationType)navigationType 
    {
        if (self.loadingUnvalidatedHTTPSPage)
        {
            self.connection = [[NSURLConnection alloc] initWithRequest:request delegate:self];
            [self.connection start];
            return NO;
        }

    4) Implement the NSURLConnectionDelegate as:

    - (void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
    {
        SecTrustRef trust = challenge.protectionSpace.serverTrust;
        NSURLCredential *cred;
        cred = [NSURLCredential credentialForTrust:trust];
        [challenge.sender useCredential:cred forAuthenticationChallenge:challenge];
    }
    
    
    - (void)connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse *)response;
    {
        NSURLRequest *requestObj = [NSURLRequest requestWithURL:self.currentURL cachePolicy:NSURLRequestReturnCacheDataElseLoad timeoutInterval:10.0];
        self.loadingUnvalidatedHTTPSPage = NO;
        [self.webView loadRequest: requestObj];
        [self.connection cancel];
    }

    It all seems to work fine.

  • 相关阅读:
    VBOX虚拟化工具做VPA学习都很方便硬件信息完全实现真实模拟
    Dynamics CRM2016 使用web api来创建注释时的注意事项
    Dynamics CRM build numbers
    域控制器的角色转移
    辅域控制器的安装方法
    利用QrCode.Net生成二维码 asp.net mvc c#
    给现有的word和pdf加水印
    利用LogParser将IIS日志插入到数据库
    短文本情感分析
    Dynamics CRM Ribbon WorkBench 当ValueRule的值为空时的设置
  • 原文地址:https://www.cnblogs.com/lisa090818/p/4276006.html
Copyright © 2011-2022 走看看