忙しい人のためのApp Transport Security

@ try! Swift Tokyo 2017 https://www.tryswift.co/tokyo/jp
発表原稿はこちら: http://niwatako.hatenablog.jp/entry/2017/03/03/162543

WWDC2016にてATS(App Transport Security)の必須化がアナウンスされました。しかしご存知の通り、必須化は延期されました。また、iOS10で新たなATSの設定を行うInfo.plistのキーが導入されましたが、iOS10のマイナーバージョンごとに仕様が異なります。このLTでは、制度も情報も仕様も混乱しているATSを5分でマスターしていただくことに挑戦します。

Transcript

1. { }
   try! Swift
   ๩͍͠ਓͷͨΊͷ App Transport Security
   Tokyo 2017
   

   View Slide

2. @ niwatako
   

   View Slide

3. View Slide

4. { }
   try! Swift
   Kyoto

   ژ౎
   

   View Slide

5. View Slide

6. View Slide

7. MacBook Gold
   

   View Slide

8. View Slide

9. { }
   try! Swift
   ๩͍͠ਓͷͨΊͷ App Transport Security
   Tokyo 2017
   

   View Slide

10. App Transport Security
    Enforcement
    

    View Slide

11. App Transport Security
    

    View Slide

12. σϑΥϧτͰ༗ޮ
    

    View Slide

13. App Transport Security
    Safe HTTPS
    Unsafe HTTPS
    HTTP
    ❌
    ❌
    

    View Slide

14. https
    • different? Safe HTTPS
    Unsafe HTTPS
    

    View Slide

15. https
    • different?
    • Hash algorithm
    • Digital sign
    • Encryption
    • …
    Safe HTTPS
    Unsafe HTTPS
    

    View Slide

16. > What’s is the “Safe HTTPS” ?
    ( ɾωɾ)ͬ Information Property List Key Reference
    https://developer.apple.com/library/prerelease/content/
    documentation/General/Reference/InfoPlistKeyReference/Articles/
    CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW57
    

    View Slide

17. $ nscurl --ats-diagnostics https://apple.com/
    

    View Slide

18. $ nscurl --ats-diagnostics https://apple.com/
    Default ATS Secure Connection
    ---
    ATS Default Connection
    Result : PASS
    ---
    

    View Slide

19. $ nscurl --ats-diagnostics https://swift.org/
    Default ATS Secure Connection
    ---
    ATS Default Connection
    2017-03-03 09:53:51.924 nscurl[82267:6343870] N
    NSURLConnection HTTP load failed (kCFStreamErro
    Result : FAIL
    ---
    

    View Slide

20. Want to connect HTTP?
    Safe HTTPS
    HTTP
    ❌
    ❌
    Unsafe HTTPS
    

    View Slide

21. 
    
    NSAllowsArbitraryLoads
    Safe HTTPS
    HTTP
    
    Unsafe HTTPS
    

    View Slide

22. NSExceptionDomains
    Safe HTTPS
    HTTP
    ❌
    ❌
    Unsafe HTTPS
    
    hatena.ne.jp hatena.ne.jp
    
    swift.org
    

    View Slide

23. New ATS Options
    

    View Slide

24. • NSAllowsArbitraryLoadsForMedia
    App Transport SecurityͷͨΊͷΦϓγϣϯ
    

    View Slide

25. • NSAllowsArbitraryLoadsForMedia
    • NSAllowsArbitraryLoadsInWebContent
    App Transport SecurityͷͨΊͷΦϓγϣϯ
    

    View Slide

26. • NSAllowsArbitraryLoadsForMedia
    • NSAllowsArbitraryLoadsInWebContent
    • NSAllowsLocalNetworking
    App Transport SecurityͷͨΊͷΦϓγϣϯ
    

    View Slide

27. • NSAllowsArbitraryLoadsForMedia
    • NSAllowsArbitraryLoadsInWebContent
    • NSAllowsLocalNetworking
    App Transport SecurityͷͨΊͷΦϓγϣϯ
    

    View Slide

28. View Slide

29. NSAllowsArbitraryLoadsInWebContent
    

    View Slide

30. NSAllowsArbitraryLoadsInWebContent
    WK: WebViewɺUI: UIWebViewɺNS: NSURLSession
    WK UI NS
    Safe HTTPS
    HTTP Unsafe HTTPS
    WK UI NS
    WK UI NS
    

    View Slide

31. ATSɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹ ATS ɹɹɹɹɹɹɹɹɹ
    WK UI NS
    Safe HTTPS
    HTTP Unsafe HTTPS
    WK UI NS
    WK UI NS
    ATS
    

    View Slide

32. NSAllowsArbitraryLoads
    WK UI NS
    Safe HTTPS
    HTTP Unsafe HTTPS
    WK UI NS
    WK UI NS
    

    View Slide

33. …
    ATSɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹ ATS ɹɹɹɹɹɹɹɹɹ
    WK UI NS
    Safe HTTPS
    HTTP Unsafe HTTPS
    WK UI NS
    WK UI NS
    

    View Slide

34. NSAllowsArbitraryLoadsInWebContent (iOS10.0)
    WK UI NS
    Safe HTTPS
    HTTP Unsafe HTTPS
    WK UI NS
    WK UI NS
    ATS ɹɹɹɹɹɹɹɹɹ
    

    View Slide

35. WK UI NS
    Safe HTTPS
    HTTP Unsafe HTTPS
    WK UI NS
    WK UI NS
    ATS ɹɹɹɹɹɹɹɹɹ
    NSAllowsArbitraryLoadsInWebContent (iOS10.0)
    

    View Slide

36. NSAllowsArbitraryLoadsInWebContent (iOS10.0)
    WK UI NS
    Safe HTTPS
    HTTP Unsafe HTTPS
    WK UI NS
    WK UI NS
    ATS ɹɹɹɹɹɹɹɹɹ
    

    View Slide

37. WK UI NS
    Safe HTTPS
    HTTP Unsafe HTTPS
    WK UI NS
    WK UI NS
    iOS10.2ʙ
    NSAllowsArbitraryLoadsInWebContent
    (iOS10.2)
    ATS ɹɹɹɹɹɹɹɹɹ ATS
    

    View Slide

38. NSAllowsArbitraryLoadsInWebContent
    (iOS10.2)
    Bug…
    WK UI NS
    Safe HTTPS
    HTTP Unsafe HTTPS
    WK UI NS
    WK UI NS
    ATS ɹɹɹɹɹɹɹɹɹ ATS
    

    View Slide

39. NSAllowsHTTPLoadsInWebContent
    NSAllowsArbitraryLoadsInWebContent
    

    View Slide

40. View Slide

41. WK UI NS
    Safe HTTPS
    HTTP Unsafe HTTPS
    WK UI NS
    WK UI NS
    ATS ɹɹɹɹɹɹɹɹɹ
    NSAllowsArbitraryLoadsInWebContent (iOS10.0)
    

    View Slide

42. WK UI NS
    Safe HTTPS
    HTTP Unsafe HTTPS
    WK UI NS
    WK UI NS
    iOS10.2ʙ
    NSAllowsArbitraryLoadsInWebContent
    (iOS10.2)
    ATS ɹɹɹɹɹɹɹɹɹ ATS
    

    View Slide

43. Required by App Store at end of 2016
    

    View Slide

44. Required by App Store at end of 2016
    Ԇظ
    

    View Slide

45. Let's use

    NSAllowsArbitraryLoads

    
    

    View Slide

46. Important Things About ATS
    • There are cases that it does not work properly.
    • You should to check 

    both the specification and the actual behavior.
    • Behaviors are different between minor versions.
    

    View Slide