Can no longer authenticate with AFNetworking/NSURLConnection with iOS10?

Question

My app uses AFNetworking 2.x to get data from a database on one of our servers. Everything has worked fine until this last week or so. Now we cannot get at least one of our connections to work. Here is the code.

NSString *loginURL =
      @"https://<server>/<path>/<url>";
  AFHTTPRequestOperationManager *manager =
      [AFHTTPRequestOperationManager manager];
  manager.requestSerializer = [AFJSONRequestSerializer serializer];
  [manager.requestSerializer
      setAuthorizationHeaderFieldWithUsername:pUserEmail
                                     password:pUserPassword];
  manager.responseSerializer = [AFJSONResponseSerializer serializer];

  AFHTTPRequestOperation *operation = [manager GET:loginURL
      parameters:[self jsonDict]
      success:^(AFHTTPRequestOperation *operation, id responseObject) {
          if (completionBlock) {
            completionBlock(YES);
          }
      }
      failure:^(AFHTTPRequestOperation *operation, NSError *error) {
          if (completionBlock) {
            completionBlock(NO);
          }
      }];
  [operation start];
} 

What is really strange to me is that if I go to the URL in a browser and enter by username/password, I get access.

If I user Xcode 7.3.1 and run in a simulator then I get access.

If I run it on my iPhone it fails and I get the following 3 error messages.

Sep 20 10:54:54 iPhone Scoular(CFNetwork)[1999] <Notice>: N -9801
 (kCFStreamErrorDomainSSL, -9801)
Sep 20 10:54:54 iPhone Scoular(CFNetwork)[1999] <Error>: HTTP load failed (error code: -1200 [3:-9801])
Sep 20 10:54:54 iPhone Scoular(CFNetwork)[1999] <Error>: NSURLConnection finished with error - code -1200

My guess is that something (NSURLConnection in iOS8 or iOS9) was deprecated, with iOS10, it is no longer allowed, and if I update to AFNetworking 3.x it will fix this issue, but I am not completely sure.

A user with iOS9 is able to authenticate.

I do not believe there have been any changes to the server.

Answer 1

In iOS 10, some cipher suites are disabled because of weak security, allowed only in web views. You may or may not be able to override that with Apple Transport Security overrides in your Info.plist file.

Either way, even if the override works, you'll have to upgrade the server by the end of 2016, so don't spend too long trying to make that work.