Apple team I tried to implement the ssl pinning in iOS through info.plist using Pinned Domains Identity Pinning as found in the official apple blog: How to configure server certificates for your app https://developer.apple.com/news/?id=g9ejcf8y%C2%A0news. As of now i have done the following changes something similar in info.plist :
And in code i have used simple URLSession as shown:
"https://wang.greenhub.example.org/sites/......./logo.png") else {
return
}
// URL session that doesn't cache.
let urlSession = URLSession(configuration: URLSessionConfiguration.ephemeral)
let task = urlSession.dataTask(with: imageUrl) { imageData, response, error in
DispatchQueue.main.async {
// Handle client errors
if let error = error {
self.HandleClientConnectionError(error: error)
return
}
// Handle server errors
guard let httpResponse = response as? HTTPURLResponse,
(200...299).contains(httpResponse.statusCode) else {
self.HandleServerError(response: response!)
return
}
self.AddImageToView(imageData: imageData!)
}
}
task.resume()
FYI we have api with multiple subdomains and thus according to the
NSIncludesSubdomains documentation here says:
it doesn’t apply to the subdomains advanced.math.example.com or ancient.history.example.com because those subdomains have two additional path components.
Also it prohibits the use of wild cards so even if i tried to use *.example.org overall the SSL pinning does not seems to work in case of multiple subdomains scenario like mine even if i replace the SHA256-BASE64 pin with wrong ones.
Can anyone from apple suggest a solution for this or tell how can we use NSIncludesSubdomains find a solution for pinning against multiple subdomains