AFSecurityPolicy Class Reference
| Inherits from | NSObject |
|---|---|
| Conforms to | NSCopying NSSecureCoding |
| Declared in | AFSecurityPolicy.h AFSecurityPolicy.m |
Overview
AFSecurityPolicy evaluates server trust against pinned X.509 certificates and public keys over secure connections.
Adding pinned SSL certificates to your app helps prevent man-in-the-middle attacks and other vulnerabilities. Applications dealing with sensitive customer data or financial information are strongly encouraged to route all communication over an HTTPS connection with SSL pinning configured and enabled.
Other Methods
SSLPinningMode
The criteria by which server trust should be evaluated against the pinned SSL certificates. Defaults to AFSSLPinningModeNone.
@property (readonly, nonatomic, assign) AFSSLPinningMode SSLPinningModeDeclared In
AFSecurityPolicy.h
pinnedCertificates
The certificates used to evaluate server trust according to the SSL pinning mode.
@property (nonatomic, strong, nullable) NSSet<NSData*> *pinnedCertificatesDiscussion
By default, this property is set to any (.cer) certificates included in the target compiling AFNetworking. Note that if you are using AFNetworking as embedded framework, no certificates will be pinned by default. Use certificatesInBundle to load certificates from your target, and then create a new policy by calling policyWithPinningMode:withPinnedCertificates.
Note that if pinning is enabled, evaluateServerTrust:forDomain: will return true if any pinned certificate matches.
Declared In
AFSecurityPolicy.h
allowInvalidCertificates
Whether or not to trust servers with an invalid or expired SSL certificates. Defaults to NO.
@property (nonatomic, assign) BOOL allowInvalidCertificatesDeclared In
AFSecurityPolicy.h
validatesDomainName
Whether or not to validate the domain name in the certificate’s CN field. Defaults to YES.
@property (nonatomic, assign) BOOL validatesDomainNameDeclared In
AFSecurityPolicy.h
Getting Certificates from the Bundle
+ certificatesInBundle:
Returns any certificates included in the bundle. If you are using AFNetworking as an embedded framework, you must use this method to find the certificates you have included in your app bundle, and use them when creating your security policy by calling policyWithPinningMode:withPinnedCertificates.
+ (NSSet<NSData*> *)certificatesInBundle:(NSBundle *)bundleReturn Value
The certificates included in the given bundle.
Declared In
AFSecurityPolicy.h
Getting Specific Security Policies
+ defaultPolicy
Returns the shared default security policy, which does not allow invalid certificates, validates domain name, and does not validate against pinned certificates or public keys.
+ (instancetype)defaultPolicyReturn Value
The default security policy.
Declared In
AFSecurityPolicy.h
Initialization
+ policyWithPinningMode:
Creates and returns a security policy with the specified pinning mode.
+ (instancetype)policyWithPinningMode:(AFSSLPinningMode)pinningModeParameters
pinningMode |
The SSL pinning mode. |
|---|
Return Value
A new security policy.
Declared In
AFSecurityPolicy.h
+ policyWithPinningMode:withPinnedCertificates:
Creates and returns a security policy with the specified pinning mode.
+ (instancetype)policyWithPinningMode:(AFSSLPinningMode)pinningMode withPinnedCertificates:(NSSet<NSData*> *)pinnedCertificatesParameters
pinningMode |
The SSL pinning mode. |
|---|---|
pinnedCertificates |
The certificates to pin against. |
Return Value
A new security policy.
Declared In
AFSecurityPolicy.h
Evaluating Server Trust
– evaluateServerTrust:forDomain:
Whether or not the specified server trust should be accepted, based on the security policy.
- (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust forDomain:(nullable NSString *)domainParameters
serverTrust |
The X.509 certificate trust of the server. |
|---|---|
domain |
The domain of serverTrust. If |
Return Value
Whether or not to trust the server.
Discussion
This method should be used when responding to an authentication challenge from a server.
Declared In
AFSecurityPolicy.h