Issue: Pentesting Team Feedback on Capture SDK: Missing NSAllowsArbitraryLoads Configuration

[chandualasyam-afk]

Your Socket Mobile Developer ID

730EDEA1-AB83-4C1F-B120-305AA9FDA172

Environment

Capture SDK Version : 1.9.166

Description

We submitted our app for penetration testing after integrating the Capture SDK. The pentesting team provided the following feedback:
"On the mobile side, the Capture SDK does not explicitly set the NSAllowsArbitraryLoads parameter, which by default permits HTTP requests. As per security best practices, this parameter should be set to false to enhance security. However, this is currently not feasible, as the SDK is integrated as a Swift package, and any manual changes to the setting are overwritten upon each reload."

Steps to Reproduce

We submitted our app for penetration testing after integrating the Capture SDK. The pentesting team provided the following feedback:
"On the mobile side, the Capture SDK does not explicitly set the NSAllowsArbitraryLoads parameter, which by default permits HTTP requests. As per security best practices, this parameter should be set to false to enhance security. However, this is currently not feasible, as the SDK is integrated as a Swift package, and any manual changes to the setting are overwritten upon each reload."

Expected Behavior

it should pass pentesting thout any errors

Actual Behavior

NA

Additional Context

No response

[EricGlaenzer]

Hi @chandualasyam-afk, thank you for reporting this. We will look into this, I just wanted to mention that due to vacation period this won't happen right away. We will keep you posted here of course.

[cyrille-socket]

Hello @chandualasyam-afk, thanks for your patience.

Actually the key NSAllowsArbitraryLoads is set in our SDK for technical reasons.

What would you need exactly? Because we cannot really remove it.

Best,
Cyrille