From a0437d2fa0307ce54f1610518e845601245fb44f Mon Sep 17 00:00:00 2001 From: Daniel Kononov Date: Tue, 16 Dec 2025 07:46:20 +0100 Subject: [PATCH 1/2] remove URLAuthenticationChallenge --- .../Classes/InAppWebView/InAppWebView.swift | 229 ------------------ 1 file changed, 229 deletions(-) diff --git a/flutter_inappwebview_ios/ios/Classes/InAppWebView/InAppWebView.swift b/flutter_inappwebview_ios/ios/Classes/InAppWebView/InAppWebView.swift index 43ac037767..203a19f641 100755 --- a/flutter_inappwebview_ios/ios/Classes/InAppWebView/InAppWebView.swift +++ b/flutter_inappwebview_ios/ios/Classes/InAppWebView/InAppWebView.swift @@ -1975,235 +1975,6 @@ public class InAppWebView: WKWebView, UIScrollViewDelegate, WKUIDelegate, inAppBrowserDelegate?.didFailNavigation(url: url, error: error) } - public func webView(_ webView: WKWebView, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) { - var completionHandlerCalled = false - if challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodHTTPBasic || - challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodDefault || - challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodHTTPDigest || - challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodNegotiate || - challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodNTLM { - let host = challenge.protectionSpace.host - let prot = challenge.protectionSpace.protocol - let realm = challenge.protectionSpace.realm - let port = challenge.protectionSpace.port - - let callback = WebViewChannelDelegate.ReceivedHttpAuthRequestCallback() - callback.nonNullSuccess = { (response: HttpAuthResponse) in - if let action = response.action { - completionHandlerCalled = true - switch action { - case 0: - InAppWebView.credentialsProposed = [] - // used .performDefaultHandling to maintain consistency with Android - // because .cancelAuthenticationChallenge will call webView(_:didFail:withError:) - completionHandler(.performDefaultHandling, nil) - //completionHandler(.cancelAuthenticationChallenge, nil) - break - case 1: - let username = response.username - let password = response.password - let permanentPersistence = response.permanentPersistence - let persistence = (permanentPersistence) ? URLCredential.Persistence.permanent : URLCredential.Persistence.forSession - let credential = URLCredential(user: username, password: password, persistence: persistence) - completionHandler(.useCredential, credential) - break - case 2: - if InAppWebView.credentialsProposed.count == 0 { - for (protectionSpace, credentials) in CredentialDatabase.credentialStore.allCredentials { - if protectionSpace.host == host && protectionSpace.realm == realm && - protectionSpace.protocol == prot && protectionSpace.port == port { - for credential in credentials { - InAppWebView.credentialsProposed.append(credential.value) - } - break - } - } - } - if InAppWebView.credentialsProposed.count == 0, let credential = challenge.proposedCredential { - InAppWebView.credentialsProposed.append(credential) - } - - if let credential = InAppWebView.credentialsProposed.popLast() { - completionHandler(.useCredential, credential) - } - else { - completionHandler(.performDefaultHandling, nil) - } - break - default: - InAppWebView.credentialsProposed = [] - completionHandler(.performDefaultHandling, nil) - } - return false - } - return true - } - callback.defaultBehaviour = { (response: HttpAuthResponse?) in - if !completionHandlerCalled { - completionHandlerCalled = true - completionHandler(.performDefaultHandling, nil) - } - } - callback.error = { [weak callback] (code: String, message: String?, details: Any?) in - print(code + ", " + (message ?? "")) - callback?.defaultBehaviour(nil) - } - - let runCallback = { - if let channelDelegate = self.channelDelegate { - channelDelegate.onReceivedHttpAuthRequest(challenge: HttpAuthenticationChallenge(fromChallenge: challenge), callback: callback) - } else { - callback.defaultBehaviour(nil) - } - } - - if windowId != nil, !windowCreated { - windowBeforeCreatedCallbacks.append(runCallback) - } else { - runCallback() - } - } - else if challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust { - guard let serverTrust = challenge.protectionSpace.serverTrust else { - completionHandler(.performDefaultHandling, nil) - return - } - - if let scheme = challenge.protectionSpace.protocol, scheme == "https" { - // workaround for ProtectionSpace SSL Certificate - // https://github.com/pichillilorenzo/flutter_inappwebview/issues/1678 - DispatchQueue.global(qos: .background).async { - if let sslCertificate = challenge.protectionSpace.sslCertificate { - DispatchQueue.main.async { - InAppWebView.sslCertificatesMap[challenge.protectionSpace.host] = sslCertificate - } - } - } - } - - let callback = WebViewChannelDelegate.ReceivedServerTrustAuthRequestCallback() - callback.nonNullSuccess = { (response: ServerTrustAuthResponse) in - if let action = response.action { - completionHandlerCalled = true - switch action { - case 0: - InAppWebView.credentialsProposed = [] - completionHandler(.cancelAuthenticationChallenge, nil) - break - case 1: - // workaround for https://github.com/pichillilorenzo/flutter_inappwebview/issues/1924 - DispatchQueue.global(qos: .background).async { - let exceptions = SecTrustCopyExceptions(serverTrust) - SecTrustSetExceptions(serverTrust, exceptions) - let credential = URLCredential(trust: serverTrust) - completionHandler(.useCredential, credential) - } - break - default: - InAppWebView.credentialsProposed = [] - completionHandler(.performDefaultHandling, nil) - } - return false - } - return true - } - callback.defaultBehaviour = { (response: ServerTrustAuthResponse?) in - if !completionHandlerCalled { - completionHandlerCalled = true - completionHandler(.performDefaultHandling, nil) - } - } - callback.error = { [weak callback] (code: String, message: String?, details: Any?) in - print(code + ", " + (message ?? "")) - callback?.defaultBehaviour(nil) - } - - let runCallback = { - if let channelDelegate = self.channelDelegate { - channelDelegate.onReceivedServerTrustAuthRequest(challenge: ServerTrustChallenge(fromChallenge: challenge), callback: callback) - } else { - callback.defaultBehaviour(nil) - } - } - - if windowId != nil, !windowCreated { - windowBeforeCreatedCallbacks.append(runCallback) - } else { - runCallback() - } - } - else if challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodClientCertificate { - let callback = WebViewChannelDelegate.ReceivedClientCertRequestCallback() - callback.nonNullSuccess = { (response: ClientCertResponse) in - if let action = response.action { - completionHandlerCalled = true - switch action { - case 0: - completionHandler(.cancelAuthenticationChallenge, nil) - break - case 1: - let certificatePath = response.certificatePath - let certificatePassword = response.certificatePassword ?? ""; - - var path: String = certificatePath - do { - if let plugin = self.plugin { - path = try Util.getAbsPathAsset(plugin: plugin, assetFilePath: certificatePath) - } - } catch {} - - if let PKCS12Data = NSData(contentsOfFile: path), - let identityAndTrust: IdentityAndTrust = self.extractIdentity(PKCS12Data: PKCS12Data, password: certificatePassword) { - let urlCredential: URLCredential = URLCredential( - identity: identityAndTrust.identityRef, - certificates: identityAndTrust.certArray as? [AnyObject], - persistence: URLCredential.Persistence.forSession); - completionHandler(.useCredential, urlCredential) - } else { - completionHandler(.performDefaultHandling, nil) - } - - break - case 2: - completionHandler(.cancelAuthenticationChallenge, nil) - break - default: - completionHandler(.performDefaultHandling, nil) - } - return false - } - return true - } - callback.defaultBehaviour = { (response: ClientCertResponse?) in - if !completionHandlerCalled { - completionHandlerCalled = true - completionHandler(.performDefaultHandling, nil) - } - } - callback.error = { [weak callback] (code: String, message: String?, details: Any?) in - print(code + ", " + (message ?? "")) - callback?.defaultBehaviour(nil) - } - - let runCallback = { - if let channelDelegate = self.channelDelegate { - channelDelegate.onReceivedClientCertRequest(challenge: ClientCertChallenge(fromChallenge: challenge), callback: callback) - } else { - callback.defaultBehaviour(nil) - } - } - - if windowId != nil, !windowCreated { - windowBeforeCreatedCallbacks.append(runCallback) - } else { - runCallback() - } - } - else { - completionHandler(.performDefaultHandling, nil) - } - } - struct IdentityAndTrust { var identityRef: SecIdentity var trust: SecTrust From 5b5673a2f3e7d2be3aca5bca985b275278d04e8c Mon Sep 17 00:00:00 2001 From: Daniel Kononov Date: Wed, 17 Dec 2025 14:39:25 +0100 Subject: [PATCH 2/2] set fixed ios version --- flutter_inappwebview/pubspec.yaml | 6 +++- .../Classes/InAppWebView/InAppWebView.swift | 36 ------------------- 2 files changed, 5 insertions(+), 37 deletions(-) diff --git a/flutter_inappwebview/pubspec.yaml b/flutter_inappwebview/pubspec.yaml index 2684b7daec..6bd197efbc 100755 --- a/flutter_inappwebview/pubspec.yaml +++ b/flutter_inappwebview/pubspec.yaml @@ -22,7 +22,11 @@ dependencies: sdk: flutter flutter_inappwebview_platform_interface: ^1.3.0 flutter_inappwebview_android: ^1.1.3 - flutter_inappwebview_ios: ^1.1.2 + flutter_inappwebview_ios: + git: + url: https://github.com/relution-io/flutter_inappwebview + ref: feature/ios_without_server_auth_challenge + path: flutter_inappwebview_ios flutter_inappwebview_macos: ^1.1.2 flutter_inappwebview_web: ^1.1.2 flutter_inappwebview_windows: ^0.6.0 diff --git a/flutter_inappwebview_ios/ios/Classes/InAppWebView/InAppWebView.swift b/flutter_inappwebview_ios/ios/Classes/InAppWebView/InAppWebView.swift index 203a19f641..93fe51b541 100755 --- a/flutter_inappwebview_ios/ios/Classes/InAppWebView/InAppWebView.swift +++ b/flutter_inappwebview_ios/ios/Classes/InAppWebView/InAppWebView.swift @@ -2343,42 +2343,6 @@ public class InAppWebView: WKWebView, UIScrollViewDelegate, WKUIDelegate, return windowWebView } - public func webView(_ webView: WKWebView, - authenticationChallenge challenge: URLAuthenticationChallenge, - shouldAllowDeprecatedTLS decisionHandler: @escaping (Bool) -> Void) { - var decisionHandlerCalled = false - let callback = WebViewChannelDelegate.ShouldAllowDeprecatedTLSCallback() - callback.nonNullSuccess = { (action: Bool) in - decisionHandlerCalled = true - decisionHandler(action) - return false - } - callback.defaultBehaviour = { (action: Bool?) in - if !decisionHandlerCalled { - decisionHandlerCalled = true - decisionHandler(false) - } - } - callback.error = { [weak callback] (code: String, message: String?, details: Any?) in - print(code + ", " + (message ?? "")) - callback?.defaultBehaviour(nil) - } - - let runCallback = { - if let channelDelegate = self.channelDelegate { - channelDelegate.shouldAllowDeprecatedTLS(challenge: challenge, callback: callback) - } else { - callback.defaultBehaviour(nil) - } - } - - if windowId != nil, !windowCreated { - windowBeforeCreatedCallbacks.append(runCallback) - } else { - runCallback() - } - } - public func webViewDidClose(_ webView: WKWebView) { channelDelegate?.onCloseWindow() }