LCSecurityPolicy

Objective-C

@interface LCSecurityPolicy : NSObject <NSSecureCoding, NSCopying>

Swift

class LCSecurityPolicy : NSObject, NSSecureCoding, NSCopying

LCSecurityPolicy evaluates server trust against pinned X.509 certificates and public keys over secure connections.

Adding pinned SSL certificates to your app helps prevent man-in-the-middle attacks and other vulnerabilities. Applications dealing with sensitive customer data or financial information are strongly encouraged to route all communication over an HTTPS connection with SSL pinning configured and enabled.

Show on GitHub

  • The criteria by which server trust should be evaluated against the pinned SSL certificates. Defaults to LCSSLPinningModeNone.

    Declaration

    Objective-C

    @property (nonatomic, readonly) LCSSLPinningMode SSLPinningMode;

    Swift

    var sslPinningMode: LCSSLPinningMode { get }
    Show on GitHub

  • The certificates used to evaluate server trust according to the SSL pinning mode.

    By default, this property is set to any (.cer) certificates included in the target compiling AFNetworking. Note that if you are using AFNetworking as embedded framework, no certificates will be pinned by default. Use certificatesInBundle to load certificates from your target, and then create a new policy by calling policyWithPinningMode:withPinnedCertificates.

    Note that if pinning is enabled, evaluateServerTrust:forDomain: will return true if any pinned certificate matches.

    Declaration

    Objective-C

    @property (nonatomic, strong, nullable) NSSet<NSData *> *pinnedCertificates;

    Swift

    var pinnedCertificates: Set<Data>? { get set }
    Show on GitHub

  • Whether or not to trust servers with an invalid or expired SSL certificates. Defaults to NO.

    Declaration

    Objective-C

    @property (nonatomic) BOOL allowInvalidCertificates;

    Swift

    var allowInvalidCertificates: Bool { get set }
    Show on GitHub

  • Whether or not to validate the domain name in the certificate’s CN field. Defaults to YES.

    Declaration

    Objective-C

    @property (nonatomic) BOOL validatesDomainName;

    Swift

    var validatesDomainName: Bool { get set }
    Show on GitHub

Getting Certificates from the Bundle

  • Returns any certificates included in the bundle. If you are using AFNetworking as an embedded framework, you must use this method to find the certificates you have included in your app bundle, and use them when creating your security policy by calling policyWithPinningMode:withPinnedCertificates.

    Declaration

    Objective-C

    + (nonnull NSSet<NSData *> *)certificatesInBundle:(nonnull NSBundle *)bundle;

    Swift

    class func certificates(in bundle: Bundle) -> Set<Data>

    Return Value

    The certificates included in the given bundle.

    Show on GitHub

Getting Specific Security Policies

  • Returns the shared default security policy, which does not allow invalid certificates, validates domain name, and does not validate against pinned certificates or public keys.

    Declaration

    Objective-C

    + (nonnull instancetype)defaultPolicy;

    Swift

    class func `default`() -> Self

    Return Value

    The default security policy.

    Show on GitHub

Initialization

  • Creates and returns a security policy with the specified pinning mode.

    Declaration

    Objective-C

    + (nonnull instancetype)policyWithPinningMode:(LCSSLPinningMode)pinningMode;

    Swift

    convenience init(pinningMode: LCSSLPinningMode)

    Parameters

    pinningMode

    The SSL pinning mode.

    Return Value

    A new security policy.

    Show on GitHub

  • Creates and returns a security policy with the specified pinning mode.

    Declaration

    Objective-C

    + (nonnull instancetype)policyWithPinningMode:(LCSSLPinningMode)pinningMode
                       withPinnedCertificates:
                           (nonnull NSSet<NSData *> *)pinnedCertificates;

    Swift

    convenience init(pinningMode: LCSSLPinningMode, withPinnedCertificates pinnedCertificates: Set<Data>)

    Parameters

    pinningMode

    The SSL pinning mode.
    pinnedCertificates

    The certificates to pin against.

    Return Value

    A new security policy.

    Show on GitHub

Evaluating Server Trust

  • Whether or not the specified server trust should be accepted, based on the security policy.

    This method should be used when responding to an authentication challenge from a server.

    Declaration

    Objective-C

    - (BOOL)evaluateServerTrust:(nonnull SecTrustRef)serverTrust
                  forDomain:(nullable NSString *)domain;

    Swift

    func evaluateServerTrust(_ serverTrust: SecTrust, forDomain domain: String?) -> Bool

    Parameters

    serverTrust

    The X.509 certificate trust of the server.
    domain

    The domain of serverTrust. If nil, the domain will not be validated.

    Return Value

    Whether or not to trust the server.

    Show on GitHub