This repository has been archived by the owner on Jan 17, 2023. It is now read-only.
Reverted NSURLSessionAuthChallengeDisposition to NSURLSessionAuthChallengeCancelAuthenticationChallenge for SSL Pinning
#3417
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…allengeCancelAuthenticationChallenge` to allow for more determistic pinning results. - Updated test suite to check for new error code
Current coverage is
|
|
This all looks good to me @kcharwood. 👍🏼 Would it also be wise to put the Apple Forums link in this PR as well for reference? |
|
Thanks @cnoon Here is a link to a Dev Forum I have opened: |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As first discussed in #3409, there appear to be cases where returning
NSURLSessionAuthChallengeRejectProtectionSpacedoes not prevent the request from succeeding in some cases.A few of us have starting to dig in on this issue. @0xced has seen behavior where the existing code does work in some cases, leading us to believe there may be some issues here related to the TLS cache under the hood that we do not control. However, using
Cancelinstead does give us deterministic control.The original intent of moving to
RejectProtectionSpacewas to provide a better error message to the developer to distinguish between a manual cancel and an SSL pinning failure.I've created a simple playground demonstrating the issue:
NSURLSessionAuthChallenge.playground.zip
This PR reverts to using cancel, and adds an additional test for Public Key Pinning error validation.
Note that if you have code specifically looking for
NSURLErrorServerCertificateUntrusted, you should fall back to useNSURLErrorCancelled