忙しい人のためのApp Transport Security

Slide 1

Slide 1 text

{ } try! Swift ๩͍͠ਓͷͨΊͷ App Transport Security Tokyo 2017

Slide 2

Slide 2 text

@ niwatako

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

{ } try! Swift Kyoto  ژ౎

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

MacBook Gold

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

{ } try! Swift ๩͍͠ਓͷͨΊͷ App Transport Security Tokyo 2017

Slide 10

Slide 10 text

App Transport Security Enforcement

Slide 11

Slide 11 text

App Transport Security

Slide 12

Slide 12 text

σϑΥϧτͰ༗ޮ

Slide 13

Slide 13 text

App Transport Security Safe HTTPS Unsafe HTTPS HTTP ❌ ❌

Slide 14

Slide 14 text

https • diﬀerent? Safe HTTPS Unsafe HTTPS

Slide 15

Slide 15 text

https • diﬀerent? • Hash algorithm • Digital sign • Encryption • … Safe HTTPS Unsafe HTTPS

Slide 16

Slide 16 text

> What’s is the “Safe HTTPS” ? ( ɾωɾ)ͬ Information Property List Key Reference https://developer.apple.com/library/prerelease/content/ documentation/General/Reference/InfoPlistKeyReference/Articles/ CocoaKeys.html#//apple_ref/doc/uid/TP40009251-SW57

Slide 17

Slide 17 text

$ nscurl --ats-diagnostics https://apple.com/

Slide 18

Slide 18 text

$ nscurl --ats-diagnostics https://apple.com/ Default ATS Secure Connection --- ATS Default Connection Result : PASS ---

Slide 19

Slide 19 text

$ nscurl --ats-diagnostics https://swift.org/ Default ATS Secure Connection --- ATS Default Connection 2017-03-03 09:53:51.924 nscurl[82267:6343870] N NSURLConnection HTTP load failed (kCFStreamErro Result : FAIL ---

Slide 20

Slide 20 text

Want to connect HTTP? Safe HTTPS HTTP ❌ ❌ Unsafe HTTPS

Slide 21

Slide 21 text

NSAllowsArbitraryLoads Safe HTTPS HTTP Unsafe HTTPS

Slide 22

Slide 22 text

NSExceptionDomains Safe HTTPS HTTP ❌ ❌ Unsafe HTTPS hatena.ne.jp hatena.ne.jp swift.org

Slide 23

Slide 23 text

New ATS Options

Slide 24

Slide 24 text

• NSAllowsArbitraryLoadsForMedia App Transport SecurityͷͨΊͷΦϓγϣϯ

Slide 25

Slide 25 text

• NSAllowsArbitraryLoadsForMedia • NSAllowsArbitraryLoadsInWebContent App Transport SecurityͷͨΊͷΦϓγϣϯ

Slide 26

Slide 26 text

• NSAllowsArbitraryLoadsForMedia • NSAllowsArbitraryLoadsInWebContent • NSAllowsLocalNetworking App Transport SecurityͷͨΊͷΦϓγϣϯ

Slide 27

Slide 27 text

• NSAllowsArbitraryLoadsForMedia • NSAllowsArbitraryLoadsInWebContent • NSAllowsLocalNetworking App Transport SecurityͷͨΊͷΦϓγϣϯ

Slide 28

Slide 28 text

No content

Slide 29

Slide 29 text

NSAllowsArbitraryLoadsInWebContent

Slide 30

Slide 30 text

NSAllowsArbitraryLoadsInWebContent WK: WebViewɺUI: UIWebViewɺNS: NSURLSession WK UI NS Safe HTTPS HTTP Unsafe HTTPS WK UI NS WK UI NS

Slide 31

Slide 31 text

ATSɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹ ATS ɹɹɹɹɹɹɹɹɹ WK UI NS Safe HTTPS HTTP Unsafe HTTPS WK UI NS WK UI NS ATS

Slide 32

Slide 32 text

NSAllowsArbitraryLoads WK UI NS Safe HTTPS HTTP Unsafe HTTPS WK UI NS WK UI NS

Slide 33

Slide 33 text

… ATSɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹɹ ATS ɹɹɹɹɹɹɹɹɹ WK UI NS Safe HTTPS HTTP Unsafe HTTPS WK UI NS WK UI NS

Slide 34

Slide 34 text

NSAllowsArbitraryLoadsInWebContent (iOS10.0) WK UI NS Safe HTTPS HTTP Unsafe HTTPS WK UI NS WK UI NS ATS ɹɹɹɹɹɹɹɹɹ

Slide 35

Slide 35 text

WK UI NS Safe HTTPS HTTP Unsafe HTTPS WK UI NS WK UI NS ATS ɹɹɹɹɹɹɹɹɹ NSAllowsArbitraryLoadsInWebContent (iOS10.0)

Slide 36

Slide 36 text

NSAllowsArbitraryLoadsInWebContent (iOS10.0) WK UI NS Safe HTTPS HTTP Unsafe HTTPS WK UI NS WK UI NS ATS ɹɹɹɹɹɹɹɹɹ

Slide 37

Slide 37 text

WK UI NS Safe HTTPS HTTP Unsafe HTTPS WK UI NS WK UI NS iOS10.2ʙ NSAllowsArbitraryLoadsInWebContent (iOS10.2) ATS ɹɹɹɹɹɹɹɹɹ ATS

Slide 38

Slide 38 text

NSAllowsArbitraryLoadsInWebContent (iOS10.2) Bug… WK UI NS Safe HTTPS HTTP Unsafe HTTPS WK UI NS WK UI NS ATS ɹɹɹɹɹɹɹɹɹ ATS

Slide 39

Slide 39 text

NSAllowsHTTPLoadsInWebContent NSAllowsArbitraryLoadsInWebContent

Slide 40

Slide 40 text

No content

Slide 41

Slide 41 text

WK UI NS Safe HTTPS HTTP Unsafe HTTPS WK UI NS WK UI NS ATS ɹɹɹɹɹɹɹɹɹ NSAllowsArbitraryLoadsInWebContent (iOS10.0)

Slide 42

Slide 42 text

WK UI NS Safe HTTPS HTTP Unsafe HTTPS WK UI NS WK UI NS iOS10.2ʙ NSAllowsArbitraryLoadsInWebContent (iOS10.2) ATS ɹɹɹɹɹɹɹɹɹ ATS

Slide 43

Slide 43 text

Required by App Store at end of 2016

Slide 44

Slide 44 text

Required by App Store at end of 2016 Ԇظ

Slide 45

Slide 45 text

Let's use  NSAllowsArbitraryLoads 

Slide 46

Slide 46 text

Important Things About ATS • There are cases that it does not work properly. • You should to check   both the speciﬁcation and the actual behavior. • Behaviors are diﬀerent between minor versions.