CODEWITHSUNDEEP
swiftssl-certificatewkwebview
Anna
Anna

Reputation: 571

SSL Pinning in swift and authentication challenge

I am trying to implement SSL pinning and I did, using the didReceiveAuthentication Challenge. I do have a question, however, is that the description of this function

https://developer.apple.com/documentation/webkit/wknavigationdelegate/1455638-webview?language=objc

and so are the URLSession Version of it, both mentioned that only when the challenge is received. My worry is that, would there be website that doesn't ask for client certificate at all? If that is the case, how am I suppose to do SSL pinning then?

Upvotes: 0

Views: 627

Answers (1)

Rob Napier
Rob Napier

Reputation: 299265

Client-side certificate pinning has nothing to do with client certificates. didReceiveAuthenticationChallenge: is called in response to receiving the server's certificate as well. In that case it's called with the protectionSpace.authenticationMethod set to NSURLAuthenticationMethodServerTrust. If the server requests a client certificate, it'll be called again with ...ClientCertificate. If Basic Auth is required, it'll be called again with ...HTTPBasic and so on.

Upvotes: 1

Related Questions