Cordova whitelist iOS 10 SSL error: Failed to load resource: An SSL error has occurred and a secure connection to the server cannot be made

Question

I am trying to send an ArrayBuffer to

https://1511921174.cloud.vimeo.com/upload?ticket_id=xxxxxxxxxx&video_file_id=xxxxxx&signature=xxxxxxxx=1%22

In iOS 10 nothing is happening. There must me a whitelisting error. I am whitelisting *.vimeo.com and *.cloud.vimeo.com per the cordova-plugin-whitelist docs. Everything works fine in iOS 9 and on Android.

<access origin="http://*.vimeo.com" subdomains="true" />
<access origin="https://*.vimeo.com" subdomains="true" />
<access origin="http://*.cloud.vimeo.com" subdomains="true" />
<access origin="https://*.cloud.vimeo.com" subdomains="true" />

Any ideas what could be happening? Thanks!

score 4 · Accepted Answer · answered Sep 23 '16 at 18:39

It looks like this isn't a whitelist but an App Transport Security issue.

I got the videos to upload to Vimeo using iOS 10. It looks like there may be a problem with Vimeo's SSL certificate. They may use an old TLS version. When I turned off the App Transport Security in the plist it just worked:

<key>NSAppTransportSecurity</key>
<dict>
  <key>NSAllowsArbitraryLoads</key>
  <true/>
</dict>

So without turning everything off I ended up adding the code below in the plist for vimeo.com only:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>vimeo.com</key>
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSThirdPartyExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSExceptionRequiresForwardSecrecy</key>
            <false/>
            <key>NSThirdPartyExceptionRequiresForwardSecrecy</key>
            <false/>
            <key>NSIncludesSubdomains</key>
            <true/>
            <key>NSExceptionMinimumTLSVersion</key>
            <string>TLSv1.0</string>
            <key>NSRequiresCertificateTransparency</key>
            <false/>
        </dict>
    </dict>
</dict>

I hope that helps anyone out there.

Only thing that got it working for me...I can swear I put this in before but it obviously didn't save...I think I had to edit the plist file directly using a text editor and not xcode. — po10cySA, Jun 28 '18 at 07:58

score 1 · Answer 2 · edited May 23 '17 at 10:32

1

I had to make tweaks to the Content-Security-Policy meta tag for iOS 10 (see here) so it's possible that you also need to add/update that, e.g.

<meta http-equiv="Content-Security-Policy" content="default-src 'self' gap: file: https://*.cloud.vimeo.com; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; media-src *">

edited May 23 '17 at 10:32

Community

1
1

answered Sep 15 '16 at 10:47

DaveAlden

30,083
11
93
155

Thanks for the comment. I added your code to my CSP but it didn't help. – Ben McMaster Sep 23 '16 at 18:24

score 0 · Answer 3 · answered Apr 02 '18 at 19:16

Before I was adding Info.Plist entries with the edit-config tag in config.xml. But for an obscure reason it wasn't working when I was overriding the NsAppTransportSecurity entry.

After some research, I that the cordova-plugin-whitelist is also translating the "access" and "allow-navigation" tags in the config.xml to a NsAppTransportSecurity entry in the Info.Plist file since october 2015 (source).

So the plugin was blocking my edit-config tag in my config.xml from overwriting this entry. According to this doc from Cordova, you can set the transport security options in the "access" and "allow-navigation" tags in config.xml. I did this and now it works great.

Cordova whitelist iOS 10 SSL error: Failed to load resource: An SSL error has occurred and a secure connection to the server cannot be made

3 Answers3

Linked