I was reviewing the documentation for NSAllowsArbitraryLoadsInWebContent:
This states:
"An optional Boolean value that applies only to content to be loaded into an instance of the following classes:
Set this key’s value to
YESNSURLSessionDefault value is
NOTo support older versions of iOS and OS X, you can employ this key and still manually configure ATS. To do so, set this key’s value to
YESNSAllowsArbitraryLoadsIf you add this key to your
Info.plistNSAllowsArbitraryLoadsAvailable starting in iOS 10.0 and macOS 10.12."
I was testing this in my app with the iOS 10 simulator (Xcode 8, beta 5), and was not able to get UIWebView to function properly on non-ATS compliant hosts -- I get an error like so:
2016-08-12 11:20:59.666 eBay[2528:1559544] NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9801)
Should we expect this to work for UIWebView in a future beta release, or is the support only available for WKWebView?
I saw Quinn's note, which only mentions WKWebView: https://forums.developer.apple.com/message/15705
I took my UIWebView test app, changed the ATS dictionary to set just
NSAllowsArbitraryLoadsInWebContent-webView:didFailLoadWithError:(lldb) po error
Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred
and a secure connection to the server cannot be made."
UserInfo={_kCFStreamErrorCodeKey=-9801,
NSLocalizedRecoverySuggestion=Would you like to connect to the
server anyway?, NSUnderlyingError=0x610000241c50 {Error
Domain=kCFErrorDomainCFNetwork Code=-1200 "An SSL error has occurred
and a secure connection to the server cannot be made."
UserInfo={NSErrorFailingURLStringKey=https://fyp.ebay.com/
EnterUserInfo?&clientapptype=16, NSLocalizedRecoverySuggestion=Would
you like to connect to the server anyway?,
_kCFNetworkCFStreamSSLErrorOriginalValue=-9801,
_kCFStreamPropertySSLClientCertificateState=0,
NSLocalizedDescription=An SSL error has occurred and a secure
connection to the server cannot be made.,
_kCFStreamErrorDomainKey=3,
NSErrorFailingURLKey=https://fyp.ebay.com/EnterUserInfo?&
clientapptype=16, _kCFStreamErrorCodeKey=-9801}},
NSLocalizedDescription=An SSL error has occurred and a secure
connection to the server cannot be made.,
NSErrorFailingURLKey=https://fyp.ebay.com/EnterUserInfo?&
clientapptype=16,
NSErrorFailingURLStringKey=https://fyp.ebay.com/EnterUserInfo?&
clientapptype=16, _kCFStreamErrorDomainKey=3}Note the failing URL,
https://fyp.ebay.comNSAllowsArbitraryLoadsInWebContentTLSTool$ TLSTool s_client -connect fyp.ebay.com:443
* input stream did open
* output stream did open
* output stream has space
* protocol: TLS 1.0
* cipher: RSA_WITH_RC4_128_MD5
* trust result: unspecified
* certificate info:
* 0 + rsaEncryption 2048 sha256-with-rsa-signature 'fyp.ebay.com'
* 1 + rsaEncryption 2048 sha256-with-rsa-signature 'Symantec Class 3 Secure Server CA - G4'
* 2 rsaEncryption 2048 sha1-with-rsa-signature 'VeriSign Class 3 Public Primary Certification Authority - G5'
^COi vey! That cypher suite,
RSA_WITH_RC4_128_MD5My guess as to what’s happening here is that
NSAllowsArbitraryLoadsInWebContentscgi.ebay.comThe obvious workaround would be to continue to use
NSAllowsArbitraryLoadsYou should also contact the site owner: the level of security for that site is way below what I would expect to see on the modern Internet.
Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"