App Transport Security

Targets macOS
1

I just updated to Xojo 2018r4 and followed the blog on App Transport Security as I was updating an old app. The general waiver in info.plist

[code]NSAppTransportSecurity

NSAllowsArbitraryLoads

[/code]
works perfectly. But when I try to designate just one specific website in the plist without “https” it doesn’t work for me. Anybody else tried it yet?

2

I just tweaked the Info.plist in the Cats example to remove the arbitrary loads key and it still seems to be working.

Examples/Communication/Web Services/CatAPI

Info.plist now looks like this:

[code]<?xml version="1.0" encoding="UTF-8"?>

NSAppTransportSecurity NSExceptionDomains thecatapi.com NSIncludesSubdomains NSThirdPartyExceptionAllowsInsecureHTTPLoads [/code]
3

Sorry Paul, but that is an invalid test. I just went to that web site and found that it is “https” (secure) anyway
You need an unsecured page to truly test this. Here is one so you don’t have to look around:
http://www.quotationspage.com

4

You’re right. Looks like TheCatAPI updated to https some time last year and I hadn’t noticed.

I’ll take a peek at your URL when I am back in the office.

5

Hello, Paul

And how do you implement this in OSX Apps ? specially that you need to run that in debug mode for testing ?

In my case I have a service provider that offer us a connector with a localhost url

http://localhost:8081/service

What can I do in this case ? I cannot even test the code as I have that error thrown. I know it is not XOJO but in some cases we really don’t need https so is there a way to add that on build time to have those options added on debug as well ?

Thanks in advance.

6

[quote=431668:@Aurelian Negrea]Hello, Paul

And how do you implement this in OSX Apps ? specially that you need to run that in debug mode for testing ?

In my case I have a service provider that offer us a connector with a localhost url

http://localhost:8081/service

What can I do in this case ? I cannot even test the code as I have that error thrown. I know it is not XOJO but in some cases we really don’t need https so is there a way to add that on build time to have those options added on debug as well ?

Thanks in advance.[/quote]
Done, fix it , it seems that I had wrong data in the plist file.

Thanks