topic Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed in .NET Maps SDK Questions

ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

NathanJoraanstad — Mon, 15 Jan 2018 14:02:12 GMT

We are currently investigating updating from the iOS native ArcGIS library (version 10.2.x) to the Xamarin .NET Runtime (version 100.x) to share code between iOS and Android. In doing so, we'll need to continue using our mapping proxy server to create a ServiceFeatureTable. Everything is working as it should on Android, but when using that same code on iOS, we are receiving the following error:

NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9813)

With the iOS native library, we get around this issue by adding our proxy server to the "ags_trustedHosts" array of NSURLConnection. However, there does not seem to be an equivalent in the Xamarin .NET Runtime (Esri.ArcGISRuntime.Xamarin.iOS, version 100.2.0).

Am I missing something here? Is there a way to use mapping proxies on iOS with the ArcGIS .NET Runtime? If this is in the works but is not available yet, is there an estimated release date for the version that will include this?

Thanks!

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

Nicholas-Furness — Tue, 16 Jan 2018 16:51:06 GMT

FYI: In Runtime 100, the iOS SDK moved the trustedHosts property to the AGSAuthenticationManager.

But we'll get this moved over for the .NET/Xamarin folks to chip in.

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

NathanJoraanstad — Tue, 16 Jan 2018 17:14:14 GMT

Hey Nicholas,

Thanks for the pointer! However, it looks like that property is not available in the .NET Runtime on iOS?

https://developers.arcgis.com/net/latest/android/api-reference/html/T_Esri_ArcGISRuntime_Security_AuthenticationManager.htm

The code below is in the iOS project (not the shared project), so it should show up on this list if it's available on the iOS .NET Runtime:

Thanks!

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

Nicholas-Furness — Tue, 16 Jan 2018 17:21:32 GMT

Indeed. I've pointed the .NET team at your question. I did overhear something about whitelisting using the project manifest/settings but since it's way out of my wheelhouse I'll wait for them to pipe up. That might give you something to look into in the meantime though.

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

NathanJoraanstad — Tue, 16 Jan 2018 17:25:15 GMT

Thanks for pointing them my direction! Hopefully, it'll be something small that I just missed.

Thanks!

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

MichaelBranscomb — Tue, 16 Jan 2018 20:09:21 GMT

Hi,

Are you referring to opting out of App Transport Security (ATS) for specific domains? If so, see this Xamarin doc for more info: App Transport Security - Xamarin

Cheers

Mike

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

NathanJoraanstad — Tue, 16 Jan 2018 22:18:17 GMT

This is not what I'm referring to. In the iOS version of the ArcGIS SDK, there is an AGSAuthenticationManager property called trustedHosts (used to be ags_trustedHosts and on NSURLConnection), but that property is not available in the .NET version. Is that just a bug, or is there a different place/way to do the same thing with the .NET version?

Thanks!

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

dotMorten_esri — Wed, 17 Jan 2018 20:00:14 GMT

The Xamarin SDK does not expose a thrusted host property. The best thing to do is sign the server with a trusted authority, or alternatively install the self-signed certificate on the phone.

There is an equivalent way that should work in Xamarin.iOS:

ServicePointManager.ServerCertificateValidationCallback += (s,c,k,e) => true;

You probably want to improve that a bit to only return true for the domain ones you "trust", as the above simple example completely disables all SSL validation. For instance you could check the thumbprint of the certificate and make sure it matches your selfsigned cert:

return c.GetCertHashString() == _TRUSTED_CERT_HASH_STRING_;

See more here: https://developer.xamarin.com/api/property/System.Net.ServicePointManager.ServerCertificateValidationCallback/

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

NathanJoraanstad — Wed, 17 Jan 2018 22:02:26 GMT

Hey Morten,

I have tried this approach, but the ServerCertificateValidationCallback is never called when using ServiceFeatureTable. It's called when I make manual network calls, but not when the ArcGIS Runtime does. Any other ideas?

Also, is there a reason why trusted host property is not available? That seemed to work well in 10.2.x versions.

Thanks!

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

NathanJoraanstad — Tue, 23 Jan 2018 21:29:39 GMT

Any other suggestions on this? We can't use the .NET Runtime if it doesn't work on iOS.

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

dotMorten_esri — Tue, 23 Jan 2018 21:56:26 GMT

Installing the self-signed certificate on your device doesn't work either?

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

NathanJoraanstad — Tue, 23 Jan 2018 22:01:21 GMT

I have not tried that, because I would have to bug our server guys who have been very busy. I'm assuming it would work, but that workflow would not be conducive for our app (since it's on the public App Store).

Is there a reason why the trustedHosts property cannot be added in the .NET Runtime? Having that work like it does in the ArcGIS iOS SDK would solve our problem.

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

dotMorten_esri — Tue, 23 Jan 2018 22:20:20 GMT

> but that workflow would not be conducive for our app (since it's on the public App Store).

The property in the iOS SDK was added for making development/testing easier. It was not meant for use in production. If you are shipping these services to production, you should make sure those servers have proper SSL certificates. If you're just going to disable SSL validation, there's no reason to use the https endpoint at all.

> Is there a reason why the trustedHosts property cannot be added in the .NET Runtime

We could consider adding this in a future release, but this wouldn't help you today. In any case, the use of disabling SSL validation is not a recommended pattern for production, and the iOS SDK property was unfortunately added first of all due to historic reasons and secondly (unfortunately) added outside the common API design that all the Runtimes have. Also due to the complexity having the .NET SDK being cross platform with vastly different underlying HTTP implementations, I'm honestly not even sure we can pull this property off and make it work everywhere.

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

NathanJoraanstad — Tue, 23 Jan 2018 22:23:27 GMT

Sounds good. Thanks for the help! I'll talk with our server team and see if we can get our servers signed with a trusted authority.

Appreciate you taking the time to help. I'll let you know if we run into any more problems with regard to this.

Thanks!

Re: ArcGIS for iOS (100.x): NSURLSession/NSURLConnection HTTP load failed

dotMorten_esri — Tue, 23 Jan 2018 22:25:06 GMT

...btw it can be done for free using https://letsencrypt.org