前言
APP项目中，嵌入了几个h5页面，页面中包含了使用【WebViewJavascriptBridge】与h5页面的交互，之前一切正常。
最近，项目的h5页面经过了SSL证书加密，变成了https请求，页面中数据不能正常加载了。页面布局可以正常展示，数据请求失败，如下：
错误页面
排查问题
1.定位问题
加密之后，iOS及安卓都出现了上述问题，安卓端经过处理后，可以正常展示（询问过后，是安卓端在webView页面做了允许http及https混合加载处理，便可正常展示了）
由于安卓端处理好了，我这边便以为是iOS端内部的问题，于是开始在网上搜索【UIWebView/WKWebView加载https】的相关文章。
2.查找解决办法
网上给出了很多种解决方法，针对的问题大多都是【由于服务器证书无效，即证书不受信任】，几种解决问题的方法如下：
<1>方法一（WKWebView）：
描述:因公司域名更换https,因而造成在wkwebView中某些网址打不开,查看错误是因为服务器证书无效,实际就是不受信任;
解决办法:在plist文件中设置
Allow Arbitrary Loads in Web Content 置为 YES,
假如有设置NSAllowsArbitraryLoads 为 YES,可不用设置上面；
实现wkwebView下面的代理方法,就可解决 :
- (void)webView:(WKWebView *)webView didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition, NSURLCredential * _Nullable credential))completionHandler{ if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) { NSURLCredential *card = [[NSURLCredential alloc]initWithTrust:challenge.protectionSpace.serverTrust]; completionHandler(NSURLSessionAuthChallengeUseCredential,card); }
}
使用此方法后，问题未解决，继续找...
<2>方法二（UIWebView）：
https使用超文本安全传输协议，即超文本传输协议（HTTP）和SSL/TLS的组合，用以提供加密通讯及对网络服务器身份的鉴定。当我们的服务器使用自我签名证书时，而UIWebView不允许使用自签名证书，所以导致加载失败。我们可以使用NSURLConnection通过它的代理canAuthenticateAgainstProtectionSpace可以允许这种情况,从而通过它进行认证。
解决方法：
#import <UIKit/UIKit.h>
#import "MyObject.h"
@interface ViewController :UIViewController<UIWebViewDelegate,NSURLConnectionDelegate>
{
UIWebView *_web;
NSURLConnection *_urlConnection;
NSURLRequest *_request;
BOOL _authenticated;
}
@end
@interfaceViewController ()
@end
@implementation ViewController
@synthesize myobject;
- (void)viewDidLoad
{
[superviewDidLoad];
_web = [[UIWebViewalloc] initWithFrame:CGRectMake(0,0,768,1024)];
_web.delegate =self;
_web.autoresizingMask =UIViewAutoresizingFlexibleWidth |UIViewAutoresizingFlexibleHeight;
[self.viewaddSubview:_web];
NSURL* _loadingURL =[NSURLURLWithString:@"https://m.facebook.com/dialog/feed?link=http%3A%2F%2Fwww.facebook.com%2FeNGage.OnePub&description=Werwr4w532545245&access_token=BAAC117qbwhQBAFtqiZAmWH8hOtkJLOcC0OTgmYJxX5IybPlPp2ozoZBewaJXBtOagJ5bJItZCZBJ8o8Sal0c52Tt4h2XbPf2f5osEo1ZB2lQh0hF969zeOpoPu1BsS5Hgtr00U55gYb7ZABsvcFohG&caption=Page%201&name=eNGage&picture=http%3A%2F%2Fc1345842.cdn.cloudfiles.rackspacecloud.com%2Fassets%2Fapps%2Ficons%2F001%2F002%2F707%2Foriginal.png%3F1324531970&actions=%5B%7B%22name%22%3A%22Find%20out%20more%20about%20eNGage%22%2C%22link%22%3A%22http%3A%2F%2Fwww.facebook.com%2FeNGage.OnePub%22%7D%5D&app_id=199938153366036&redirect_uri=fbconnect%3A%2F%2Fsuccess&sdk=2&display=touch"];
//_loadingURL=[NSURLRequest setAllowsAnyHTTPSCertificate:YES forHost:[_loadingURL host]];
_request = [NSMutableURLRequestrequestWithURL:_loadingURL];
[_webloadRequest:_request];
// Do any additional setup after loading the view, typically from a nib.
// UIImageView *uimage=[[UIImageView alloc] initWithImage:[UIImage imageNamed:@"image27.png"]];
// [self.view addSubview:uimage];
// MyObject *object=[[MyObject alloc]init];
// MyObject *object1=[object retain];
//self.myobject=object;
//myobject = object;
//NSLog(@"******retainCount:%d",[myobject retainCount]);
//NSLog(@"******self.retainCount:%d",[self.myobject retainCount]);
//[object release];
}
- (void)didReceiveMemoryWarning
{
[superdidReceiveMemoryWarning];
// Dispose of any resources that can be recreated.
}
#pragma mark - Webview delegate
// Note: This method is particularly important. As the server is using a self signed certificate,
// we cannot use just UIWebView - as it doesn't allow for using self-certs. Instead, we stop the
// request in this method below, create an NSURLConnection (which can allow self-certs via the delegate methods
// which UIWebView does not have), authenticate using NSURLConnection, then use another UIWebView to complete
// the loading and viewing of the page. See connection:didReceiveAuthenticationChallenge to see how this works.
- (BOOL)webView:(UIWebView *)webView shouldStartLoadWithRequest:(NSURLRequest *)request navigationType:(UIWebViewNavigationType)navigationType;
{
NSLog(@"Did start loading: %@ auth:%d", [[requestURL]absoluteString],_authenticated);
if (!_authenticated) {
_authenticated =NO;
_urlConnection = [[NSURLConnectionalloc] initWithRequest:_requestdelegate:self];
[_urlConnectionstart];
returnNO;
}
returnYES;
}
- (void)webView:(UIWebView *)webView didFailLoadWithError:(NSError *)error {
// 102 == WebKitErrorFrameLoadInterruptedByPolicyChange
NSLog(@"***********error:%@,errorcode=%d,errormessage:%@",error.domain,error.code,error.description);
if (!([error.domainisEqualToString:@"WebKitErrorDomain"] && error.code ==102)) {
//[self dismissWithError:error animated:YES];
}
}
#pragma mark - NURLConnection delegate
- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge;
{
NSLog(@"WebController Got auth challange via NSURLConnection");
if ([challengepreviousFailureCount] ==0)
{
_authenticated =YES;
NSURLCredential *credential = [NSURLCredentialcredentialForTrust:challenge.protectionSpace.serverTrust];
[challenge.senderuseCredential:credentialforAuthenticationChallenge:challenge];
} else
{
[[challenge sender]cancelAuthenticationChallenge:challenge];
}
}
- (void)connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse*)response;
{
NSLog(@"WebController received response via NSURLConnection");
// remake a webview call now that authentication has passed ok.
_authenticated =YES;
[_webloadRequest:_request];
// Cancel the URL connection otherwise we double up (webview + url connection, same url = no good!)
[_urlConnectioncancel];
}
// We use this method is to accept an untrusted site which unfortunately we need to do, as our PVM servers are self signed.
- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace
{
return[protectionSpace.authenticationMethodisEqualToString:NSURLAuthenticationMethodServerTrust];
}
@end
/*************************************************************other****************************************************/
BOOL _Authenticated;
NSURLRequest *_FailedRequest;
#pragma UIWebViewDelegate
-(BOOL)webView:(UIWebView *)webView shouldStartLoadWithRequest:(NSURLRequest *)request navigationType:(UIWebViewNavigationType)navigationType {
BOOL result = _Authenticated;
if (!_Authenticated) {
_FailedRequest = request;
NSURLConnection *urlConnection = [[NSURLConnection alloc] initWithRequest:request delegate:self];
[urlConnection start];
}
return result;
}
#pragma NSURLConnectionDelegate
-(void)connection:(NSURLConnection *)connection willSendRequestForAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
NSURL* baseURL = [NSURL URLWithString:@"your url"];
if ([challenge.protectionSpace.host isEqualToString:baseURL.host]) {
NSLog(@"trusting connection to host %@", challenge.protectionSpace.host);
[challenge.sender useCredential:[NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust] forAuthenticationChallenge:challenge];
} else
NSLog(@"Not trusting connection to host %@", challenge.protectionSpace.host);
}
[challenge.sender continueWithoutCredentialForAuthenticationChallenge:challenge];
}
-(void)connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse *)pResponse {
_Authenticated = YES;
[connection cancel];
[self.webView loadRequest:_FailedRequest];
}
- (void)viewDidLoad{
[super viewDidLoad];
NSURL *url = [NSURL URLWithString:@"your url"];
NSURLRequest *requestURL = [NSURLRequest requestWithURL:url];
[self.webView loadRequest:requestURL];
// Do any additional setup after loading the view.
}
/*************************************************************other****************************************************/
#pragma mark - Webview delegate
// Note: This method is particularly important. As the server is using a self signed certificate,
// we cannot use just UIWebView - as it doesn't allow for using self-certs. Instead, we stop the
// request in this method below, create an NSURLConnection (which can allow self-certs via the delegate methods
// which UIWebView does not have), authenticate using NSURLConnection, then use another UIWebView to complete
// the loading and viewing of the page. See connection:didReceiveAuthenticationChallenge to see how this works.
- (BOOL)webView:(UIWebView *)webView shouldStartLoadWithRequest:(NSURLRequest *)request navigationType:(UIWebViewNavigationType)navigationType;
{
NSLog(@"Did start loading: %@ auth:%d", [[request URL] absoluteString], _authenticated);
if (!_authenticated) {
_authenticated = NO;
_urlConnection = [[NSURLConnection alloc] initWithRequest:_request delegate:self];
[_urlConnection start];
return NO;
}
return YES;
}
#pragma mark - NURLConnection delegate
- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge;
{
NSLog(@"WebController Got auth challange via NSURLConnection");
if ([challenge previousFailureCount] == 0)
{
_authenticated = YES;
NSURLCredential *credential = [NSURLCredential credentialForTrust:challenge.protectionSpace.serverTrust];
[challenge.sender useCredential:credential forAuthenticationChallenge:challenge];
} else
{
[[challenge sender] cancelAuthenticationChallenge:challenge];
}
}
- (void)connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse *)response;
{
NSLog(@"WebController received response via NSURLConnection");
// remake a webview call now that authentication has passed ok.
_authenticated = YES;
[_web loadRequest:_request];
// Cancel the URL connection otherwise we double up (webview + url connection, same url = no good!)
[_urlConnection cancel];
}
// We use this method is to accept an untrusted site which unfortunately we need to do, as our PVM servers are self signed.
- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace
{
return [protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust];
}
使用上述方法，问题未解决，继续...
<3>方法三：
找到appdelegate.m文件，找到@end
在@end下面敲入如下代码。
@implementation NSURLRequest(DataController)
+ (BOOL)allowsAnyHTTPSCertificateForHost:(NSString *)host
{
return YES;
}
@end
依然未解决，继续...
<4>方法四：
创建AFHTTPSessionManager的类别：
@interface NetManager : AFHTTPSessionManager
+ (instancetype)share;
@end
@implementation NetManager
+ (instancetype)share{
static NetManager *manager;
static dispatch_once_t onceToken;
dispatch_once(&onceToken, ^{
NSURLSessionConfiguration *configuration = [NSURLSessionConfiguration defaultSessionConfiguration];
manager = [[self alloc] initWithBaseURL:[NSURL URLWithString:kApiBaseUrl] sessionConfiguration:configuration];
[manager setSecurityPolicy:[self customSecurityPolicy]];
});
return manager;
}
+ (AFSecurityPolicy *)customSecurityPolicy {
// 先导入证书 证书由服务端生成，具体由服务端人员操作
NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"m2" ofType:@"cer"];//证书的路径 xx.cer
NSData *cerData = [NSData dataWithContentsOfFile:cerPath];
// AFSSLPinningModeCertificate 使用证书验证模式
AFSecurityPolicy *securityPolicy = [AFSecurityPolicy policyWithPinningMode:AFSSLPinningModeCertificate];
// allowInvalidCertificates 是否允许无效证书（也就是自建的证书），默认为NO
// 如果是需要验证自建证书，需要设置为YES
securityPolicy.allowInvalidCertificates = YES;
//validatesDomainName 是否需要验证域名，默认为YES;
//假如证书的域名与你请求的域名不一致，需把该项设置为NO；如设成NO的话，即服务器使用其他可信任机构颁发的证书，也可以建立连接，这个非常危险，建议打开。
//置为NO，主要用于这种情况：客户端请求的是子域名，而证书上的是另外一个域名。因为SSL证书上的域名是独立的，假如证书上注册的域名是www.google.com，那么mail.google.com是无法验证通过的；当然，有钱可以注册通配符的域名*.google.com，但这个还是比较贵的。
//如置为NO，建议自己添加对应域名的校验逻辑。
securityPolicy.validatesDomainName = NO;
securityPolicy.pinnedCertificates = [[NSSet alloc] initWithObjects:cerData, nil];
return securityPolicy;
}
@end
依然，无效...
解决问题
1.经过多种方法尝试，依然未解决问题，只好在QQ群中求助。
大神果然是大神，一语中的：
求助结果
2.在网上看到一篇文章，发给后端看：
WechatIMG576.png
于是后端改了请求头，但...依然不行
3.通过在Safari浏览器中调试后，终于发现了问题所在：
(如何在浏览器中向h5页面传参，下篇见)
错误信息
问题所在
4.把报错信息及发给后端看，发现是h5页面中的接口，是http而非https，于是后端做了修改，接口改为https，又出现如下错误：
服务器证书问题
5.接口改为https后，依然不行，在浏览器中打开接口链接，提示证书无效：
证书错误
经后端的一顿操作后，证书可以了，但依然报请求头的问题，效果如下：
WechatIMG9.jpeg
6.还记得在刚开始的时候，后端修改请求头的事情吗？
没错，就是那个导致了现在的局面，待后端把请求头改回去后，完美解决：
ok
总结
忙活了一周，结果发现是后端的问题，好在最终完美解决了~
