Search code examples
securitysslhttpswkwebviewpinning

Public key pinning in a WKWebView

According to caniuse.com iOS Safari 9.2 and 9.3 do not support TLS public key pinning with the header Public-Key-Pins.

How can I do public key pinning with a WKWebView?

Solution

  • WkWebView gives you a handler for validating the server's certificate chain in your WKNavigationDelegate's webView:didReceiveAuthenticationChallenge:completionHandler: (https://developer.apple.com/library/ios/documentation/WebKit/Reference/WKNavigationDelegate_Ref/index.html).

    There are more details in the "Pinning in Webviews" section of this article: https://datatheorem.github.io/TrustKit/getting-started.html and it's also a library for implement public key pinning in iOS Apps.