| 注册
请输入搜索内容

热门搜索

Java Linux MySQL PHP JavaScript Hibernate jQuery Nginx
dzfeibao
8年前发布

iOS实用篇:Https双向认证

   <p>年前的时候,关于苹果要强制https的传言四起,虽然结果只是一个“谣言”,但是很明显的这是迟早会到来的,间接上加速了各公司加紧上https的节奏,对于iOS客户端来说,上https需不需要改变一些东西取决于---------对,就是公司有没有钱。土豪公司直接买买买,iOS开发者只需要把http改成https完事。然而很不幸,我们在没钱的公司,选择了自签证书。虽然网上很多关于https的适配,然而很多都是已过时的,这里我们主要是讲一下https双向认证。</p>    <p>【证书选择】自签</p>    <p>【网络请求】原生NSURLSession或者AFNetworking3.0以上版本</p>    <p>【认证方式】双向认证</p>    <p>Https双向认证过程</p>    <p>先来了解一下双向认证的大体过程:(图片来自网络,如果是某位博主原创的请私信我)</p>    <p><img src="https://simg.open-open.com/show/8f533165845017740287b671831f357d.png"></p>    <p>httpsLine.png</p>    <p>下面我们一步步来实现</p>    <p>1、设置服务端证书</p>    <pre>  <code class="language-objectivec">NSString *certFilePath = [[NSBundle mainBundle] pathForResource:@"server" ofType:@"cer"];      NSData *certData = [NSData dataWithContentsOfFile:certFilePath];      NSSet *certSet = [NSSet setWithObject:certData];      AFSecurityPolicy *policy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate withPinnedCertificates:certSet];      policy.allowInvalidCertificates = YES;      policy.validatesDomainName = NO;      self.afnetworkingManager.securityPolicy = policy;</code></pre>    <p>2、处理挑战</p>    <p>原生的NSURLSession是在</p>    <pre>  <code class="language-objectivec">- (void)URLSession:(NSURLSession *)session didReceiveChallenge:(nonnull NSURLAuthenticationChallenge *)challenge completionHandler:(nonnull void (^)(NSURLSessionAuthChallengeDisposition, NSURLCredential * _Nullable))completionHandler</code></pre>    <p>代理方法里面处理挑战的,再看看AFNetworking在该代理方法里处理的代码</p>    <pre>  <code class="language-objectivec">if (self.taskDidReceiveAuthenticationChallenge) {          disposition = self.taskDidReceiveAuthenticationChallenge(session, task, challenge, &credential);      } else {          ...      }</code></pre>    <p>我们只需要给它传递一个处理的block</p>    <pre>  <code class="language-objectivec">[self.afnetworkingManager setSessionDidReceiveAuthenticationChallengeBlock:^NSURLSessionAuthChallengeDisposition(NSURLSession*session, NSURLAuthenticationChallenge *challenge, NSURLCredential *__autoreleasing*_credential) {          ...  }</code></pre>    <p>根据传来的challenge生成disposition(应对挑战的方式)和credential(客户端生成的挑战证书)</p>    <p>3、服务端认证</p>    <p>当challenge的认证方法为NSURLAuthenticationMethodServerTrust时,需要客户端认证服务端证书</p>    <pre>  <code class="language-objectivec">//评估服务端安全性  if([weakSelf.afnetworkingManager.securityPolicy evaluateServerTrust:challenge.protectionSpace.serverTrust forDomain:challenge.protectionSpace.host]) {                  //创建凭据                  credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust];                  if(credential) {                      disposition =NSURLSessionAuthChallengeUseCredential;                  } else {                      disposition =NSURLSessionAuthChallengePerformDefaultHandling;                  }              } else {                  disposition = NSURLSessionAuthChallengeCancelAuthenticationChallenge;              }</code></pre>    <p>4、客户端认证</p>    <p>认证完服务端后,需要认证客户端</p>    <p>由于是双向认证,这一步是必不可省的</p>    <pre>  <code class="language-objectivec">SecIdentityRef identity = NULL;              SecTrustRef trust = NULL;              NSString *p12 = [[NSBundle mainBundle] pathForResource:@"client"ofType:@"p12"];              NSFileManager *fileManager =[NSFileManager defaultManager];                if(![fileManager fileExistsAtPath:p12])              {                  NSLog(@"client.p12:not exist");              }              else              {                  NSData *PKCS12Data = [NSData dataWithContentsOfFile:p12];                    if ([[weakSelf class]extractIdentity:&identity andTrust:&trust fromPKCS12Data:PKCS12Data])                  {                      SecCertificateRef certificate = NULL;                      SecIdentityCopyCertificate(identity, &certificate);                      const void*certs[] = {certificate};                      CFArrayRef certArray =CFArrayCreate(kCFAllocatorDefault, certs,1,NULL);                      credential =[NSURLCredential credentialWithIdentity:identity certificates:(__bridge  NSArray*)certArray persistence:NSURLCredentialPersistencePermanent];                      disposition =NSURLSessionAuthChallengeUseCredential;                  }              }</code></pre>    <pre>  <code class="language-objectivec">+ (BOOL)extractIdentity:(SecIdentityRef*)outIdentity andTrust:(SecTrustRef *)outTrust fromPKCS12Data:(NSData *)inPKCS12Data {      OSStatus securityError = errSecSuccess;      //client certificate password      NSDictionary*optionsDictionary = [NSDictionary dictionaryWithObject:@"your p12 file pwd"                                                                   forKey:(__bridge id)kSecImportExportPassphrase];        CFArrayRef items = CFArrayCreate(NULL, 0, 0, NULL);      securityError = SecPKCS12Import((__bridge CFDataRef)inPKCS12Data,(__bridge CFDictionaryRef)optionsDictionary,&items);        if(securityError == 0) {          CFDictionaryRef myIdentityAndTrust =CFArrayGetValueAtIndex(items,0);          const void*tempIdentity =NULL;          tempIdentity= CFDictionaryGetValue (myIdentityAndTrust,kSecImportItemIdentity);          *outIdentity = (SecIdentityRef)tempIdentity;          const void*tempTrust =NULL;          tempTrust = CFDictionaryGetValue(myIdentityAndTrust,kSecImportItemTrust);          *outTrust = (SecTrustRef)tempTrust;      } else {          NSLog(@"Failedwith error code %d",(int)securityError);          return NO;      }      return YES;  }</code></pre>    <p>原生NSURLSession双向认证</p>    <p>在原生的代理方法里面认证就行,代码基本和AFNetworking的一致,注意最后需要调用</p>    <pre>  <code class="language-objectivec">completionHandler(NSURLSessionAuthChallengeUseCredential, credential);</code></pre>    <p>来执行回调操作</p>    <p>关于UIWebView的Https双向认证</p>    <p>网上的资料大体上有几种解决方法</p>    <p>1:跳过Https认证(这还能跳过?没试过,不太靠谱)</p>    <p>2:中断原有的请求步骤,将request拿出来,下载完整的HTML代码,让webView加载该代码(在单页面展示的情况下基本满足使用,但是在部分标签不是独立跳转https路径的时候,将出现无法加载的情况,不是很好用)</p>    <pre>  <code class="language-objectivec">- (BOOL)webView:(UIWebView *)webView shouldStartLoadWithRequest:(NSURLRequest *)request navigationType:(UIWebViewNavigationType)navigationType {      NSString * urlString = [request.URL absoluteString];      if ([urlString containsString:URL_API_BASE]) {          [[SUHTTPOperationManager manager]REQUEST:request progress:nil handler:^(BOOL isSucc, id responseObject, NSError *error) {              NSString * htmlString = [[NSString alloc] initWithData:responseObject encoding:NSUTF8StringEncoding];              BASE_INFO_FUN(@"下载HTML完毕");              [self loadHTMLString:htmlString baseURL:nil];          }];          return NO;      }      return YES;  }</code></pre>    <p>3、中断原有的请求步骤,将request拿出来,完成鉴权认证之后,再让webView重新请求该request(这种方式理论上好像可以,我试过,没有成功,可能我打开的方式不正确)</p>    <p>4、或许,您有更好的解决方案 - -</p>    <p>关于代码</p>    <p>网上很多https双向认证的代码,基本是一样的,这里我们直接拿来用就可以,前提是我们不能单纯copy,而是在理解其实现的基础上,整合到工程中,遇到问题解决思路清晰,而不是一脸懵逼。</p>    <p>PS:大半年没更新文章了,也没怎么上简书,发现还是有很多人支持的,有朋友的私信也没回复,表示歉意。接下来如果可以我会试着分享一下FFmpeg编解码原理代码的个人理解(虽然我也是新手),最后坐标广州,寻找更好的机会,求带哦</p>    <p> </p>    <p>来自:http://www.jianshu.com/p/72bf60b5f94d</p>    <p> </p>    
 本文由用户 dzfeibao 自行上传分享,仅供网友学习交流。所有权归原作者,若您的权利被侵害,请联系管理员。
 转载本站原创文章,请注明出处,并保留原始链接、图片水印。
 本站是一个以用户分享为主的开源技术平台,欢迎各类分享!
 本文地址:https://www.open-open.com/lib/view/open1490838169008.html
iOS开发 移动开发 HTTPS