在iOS 9中禁用应用内浏览器的ATS？ [英] Disabling ATS for an in-app browser in iOS 9?

问题描述

iOS 9推出应用程序传输安全（ATS）以鼓励使用安全连接。

iOS 9 introduces App Transport Security (ATS) to encourage the use of secure connections.

这很棒，但如果我的应用程序怎么办？有一个内置的Web浏览器，用户应该可以用来连接到任何网站？例如，Facebook应用程序允许故事包含指向外部网站的链接。当用户点击这样的链接，而不是启动Safari时，它会启动应用内浏览器。

This is great, but what if my app has a built in web browser that the user should be able to use to connect to any website? For example, the Facebook app allows stories to contain links to external websites. When the user taps such a link, rather than launching Safari, it launches an in-app browser.

如果没有启用全局NSAllowArbitraryLoads标志？

我想要强制执行https使用的所有好处，但想要在我的内部浏览器中禁用此检查。在一个理想的世界中，Apple允许我在我的UIWebView上指定一个属性，以允许它加载不安全的URL，而不是全部或全部。我无法将每个域列入白名单，因为我不知道用户将加载哪些URL。我正在寻找与iOS 8兼容的解决方案。

I want all the benefits of enforcing https usage, but want to disable this check in my internal browser. In an ideal world, Apple would allow me to specify a property on my UIWebView to allow it to load insecure URLs, rather than it being all or nothing. There is no way I can whitelist every single domain, since I have no idea which URLs my users will load. I'm looking for a solution that is compatible with iOS 8.

推荐答案

而不是启用 NSAllowsArbitraryLoads ，更安全的解决方案是有条件地使用 SFSafariViewController，它允许任意加载。

Rather than enabling NSAllowsArbitraryLoads, a more secure solution is to conditionally use SFSafariViewController, which allows arbitrary loads.

如果该类存在，则显示它，否则，呈现您自己的UIViewController（包含UIWebView）。

If the class exists, then present it, otherwise, present your own UIViewController (which contains a UIWebView).

UIViewController *webBrowser;
if ([SFSafariViewController class] != nil) {
    webBrowser = [[SFSafariViewController alloc] initWithURL:url];
} else {
    webBrowser = [[ABCWebBrowserController alloc] initWithURL:url];
}

[self presentViewController:webBrowser animated:YES completion:nil];

这篇关于在iOS 9中禁用应用内浏览器的ATS？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！