11

In the app I'm working on, I need to handle 3-D Secure redirects from our payment service provider. These redirects point to a web page of the card issuer that is shown in a WKWebView to the user in the app.

This works all the time except one case where the WKWebView doesn't load for https://3dsecure.csas.cz/ and fails with the following error:

Error Domain=NSURLErrorDomain
Code=-1200
"An SSL error has occurred and a secure connection to the server cannot be made."

What's interesting is that the same URL loads with no problems in Safari or in SFSafariViewController. Even the server's certificate is okay:

Safari screenshot - certificate for 3dsecure.csas.cz

I've tried to play around with NSAppTransportSecurity settings in app's Info.plist file, specifically enable NSAllowsArbitraryLoadsInWebContent and NSAllowsArbitraryLoads but it does have no effect.

Tom Kraina
  • 3,569
  • 1
  • 38
  • 58

1 Answers1

18

Forward Secrecy

It turns out that the server for 3dsecure.csas.cz does not support Forward Secrecy: https://www.ssllabs.com/ssltest/analyze.html?d=3dsecure.csas.cz&s=194.50.240.77

Perfect forward secrecy is required by App Transport Security in iOS9 and above for all app connections, including webviews (not including Safari, however)

ATS Debugging

Running the following command in Terminal runs ATS diagnostics and tells more about the problem and how to solve it:

/usr/bin/nscurl --ats-diagnostics --verbose https://3dsecure.csas.cz

ATS Exception in the app

Allowing the webview in the app to connect to a specific server that does not support forward secrecy could be done by adding the following in the Info.plist file:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>3dsecure.csas.cz</key>
        <dict>
            <key>NSExceptionRequiresForwardSecrecy</key>
            <false/>
        </dict>
    </dict>
</dict>

Not future-proof

This exception needs to be added for every single domain that does not support forward secrecy. Unfortunately, It's impossible to know all the 3-d secure servers in advance as they come as redirects from the payment provider.

What I don't know is if not requiring forward secrecy could be set for any domain, globally, and just within a specific webview, without affecting the whole app.

Community
  • 1
  • 1
Tom Kraina
  • 3,569
  • 1
  • 38
  • 58
  • 2
    Will give you a bounty because this will save me a lot of time. – Sulthan Jan 14 '19 at 18:46
  • Note: I remember contacting the tech support of the CSAS but I believe I never heard back from them. Feel free to contact them too so workarounds like this won't be needed in the future. – Tom Kraina Jan 15 '19 at 15:43