Hi,
I am looking for a definitive answer to a few questions. I hope I can paint a clear picture below.
Here's the line-up:
- Cordova App, targets iOS 8.x+
- Discovers embedded device via Bonjour on the local network. This part of the app is bundled with the IPA and submitted for inclusion in the App Store.
- If the local network is unable to run Bonjour (it happens..), we fall back to either allowing the user to enter an IP adress manually or scan the local subnet for our backend service.
- App runs webview with local network content, served by the embedded device. This is another app basically, independent from the initial discovery / connect part bundled with the IPA.
Now, this is where it gets complicated. Please correct me if my assumptions are wrong:
- App Store allows Apps that use a webview (Cordova) to browse external URLs. Correct? In our case, the embedded device is the external URL and we run an AngularJS App that is run in the primary Cordova webview.
- ATS is configured to allow any connections since we're connecting to a local device. Since we're browsing a device on the local network, we can't whitelist IP ranges or domains. Therefore, we need to whitelist by wildcard (*). Our device doesn't need an internet connection to work and we don't want to depend on it - therefore an external DNS lookup trick is not an option. As read on other threads on this forum, this is an issue that yet has to be addressed. What's Apple's stand on this?
- For HTML content and API connections over HTTP, we are wondering how the HTTPS policy effective 2017 affects our use case. I looked into self signed certificates and there's even Cordova plugins allowing the app to be shipped with a self signed certificate, but that is highly doubtful and probably never makes it through the review process? The only other option currently seems to run your own CA - which needs manual steps for setup (installing root CA on the iOS device, not feasible).
- What are the options to submit to the App Store if the entire App depends on an embedded device? What if we can't ship a device for review just yet but still want to dry-run the submitting process? The app can be run and instead of discovering a local device, the review person can use an IP adress and connect to a device, by means of NAT.
Thanks,
Oliver
