feat(iOS): Allow plugins to hook into handling WebView URL authentication challenges

cli/src/tasks/copy.ts

@@ -65,7 +65,11 @@ export async function copy(config: Config, platformName: string, inline = false)
     }
 
     let usesSSLPinning = false;
-    if (allPlugins.filter((plugin) => plugin.id === '@ionic-enterprise/ssl-pinning').length > 0) {
+    if (
+      allPlugins.filter(
+        (plugin) => plugin.id === '@ionic-enterprise/ssl-pinning' || plugin.id === '@capacitor/ssl-pinning',
+      ).length > 0
+    ) {
       usesSSLPinning = true;
     }
 

ios/Capacitor/Capacitor.xcodeproj/project.pbxproj

@@ -80,6 +80,7 @@
 		62FABD1A25AE5C01007B3814 /* Array+Capacitor.swift in Sources */ = {isa = PBXBuildFile; fileRef = 62FABD1925AE5C01007B3814 /* Array+Capacitor.swift */; };
 		62FABD2325AE60BA007B3814 /* BridgedTypesTests.m in Sources */ = {isa = PBXBuildFile; fileRef = 62FABD2225AE60BA007B3814 /* BridgedTypesTests.m */; };
 		62FABD2B25AE6182007B3814 /* BridgedTypesHelper.swift in Sources */ = {isa = PBXBuildFile; fileRef = 62FABD2A25AE6182007B3814 /* BridgedTypesHelper.swift */; };
+		95116A122EC242F5004FC93B /* PluginURLAuthChallenge.swift in Sources */ = {isa = PBXBuildFile; fileRef = 95116A112EC242E0004FC93B /* PluginURLAuthChallenge.swift */; };
 		A327E6B628DB8B2900CA8B0A /* HttpRequestHandler.swift in Sources */ = {isa = PBXBuildFile; fileRef = A327E6B228DB8B2800CA8B0A /* HttpRequestHandler.swift */; };
 		A327E6B728DB8B2900CA8B0A /* CapacitorHttp.swift in Sources */ = {isa = PBXBuildFile; fileRef = A327E6B428DB8B2900CA8B0A /* CapacitorHttp.swift */; };
 		A327E6B828DB8B2900CA8B0A /* CapacitorUrlRequest.swift in Sources */ = {isa = PBXBuildFile; fileRef = A327E6B528DB8B2900CA8B0A /* CapacitorUrlRequest.swift */; };
@@ -237,6 +238,7 @@
 		62FABD1925AE5C01007B3814 /* Array+Capacitor.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "Array+Capacitor.swift"; sourceTree = "<group>"; };
 		62FABD2225AE60BA007B3814 /* BridgedTypesTests.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = BridgedTypesTests.m; sourceTree = "<group>"; };
 		62FABD2A25AE6182007B3814 /* BridgedTypesHelper.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BridgedTypesHelper.swift; sourceTree = "<group>"; };
+		95116A112EC242E0004FC93B /* PluginURLAuthChallenge.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PluginURLAuthChallenge.swift; sourceTree = "<group>"; };
 		A327E6B228DB8B2800CA8B0A /* HttpRequestHandler.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = HttpRequestHandler.swift; sourceTree = "<group>"; };
 		A327E6B428DB8B2900CA8B0A /* CapacitorHttp.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = CapacitorHttp.swift; sourceTree = "<group>"; };
 		A327E6B528DB8B2900CA8B0A /* CapacitorUrlRequest.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = CapacitorUrlRequest.swift; sourceTree = "<group>"; };
@@ -353,6 +355,7 @@
 		62959AE12524DA7700A3D7F1 /* Capacitor */ = {
 			isa = PBXGroup;
 			children = (
+				95116A112EC242E0004FC93B /* PluginURLAuthChallenge.swift */,
 				A7D9312C2B2370EF00FF59A2 /* Codable */,
 				0F8F33B127DA980A003F49D6 /* PluginConfig.swift */,
 				A76739782B98E09700795F7B /* PrivacyInfo.xcprivacy */,
@@ -715,6 +718,7 @@
 				A7187FD22BD1CB7D00093C45 /* CAPPluginMethod.swift in Sources */,
 				621ECCBC2542046400D3D615 /* JSTypes.swift in Sources */,
 				621ECCDA254205C400D3D615 /* CapacitorBridge.swift in Sources */,
+				95116A122EC242F5004FC93B /* PluginURLAuthChallenge.swift in Sources */,
 				62959B382524DA7800A3D7F1 /* CAPPluginCall.m in Sources */,
 				623D690A254C6FDF002D01D1 /* CAPInstanceDescriptor.m in Sources */,
 				A7D8B3522B238A840003FAD6 /* JSValueEncoder.swift in Sources */,

ios/Capacitor/Capacitor/CAPPlugin.h

@@ -5,6 +5,7 @@
 @class CAPPluginCall;
 
 @class PluginConfig;
+@class PluginURLAuthChallenge;
 
 @interface CAPPlugin : NSObject
 
@@ -38,6 +39,11 @@
  * Returning nil will defer to the default Capacitor policy
  */
 - (NSNumber* _Nullable)shouldOverrideLoad:(WKNavigationAction* _Nonnull)navigationAction;
+/**
+ * Allows plugins to hook into and respond to the WebView's URL authentication challenge.
+ * Returning nil will defer to the default response of [.rejectProtectionSpace](https://developer.apple.com/documentation/Foundation/URLSession/AuthChallengeDisposition/rejectProtectionSpace).
+ */
+- (PluginURLAuthChallenge* _Nullable)handleWKWebViewURLAuthenticationChallenge:(NSURLAuthenticationChallenge* _Nonnull)challenge;
 
 // Called after init if the plugin wants to do
 // some loading so the plugin author doesn't

ios/Capacitor/Capacitor/CAPPlugin.m

@@ -171,5 +171,9 @@ - (NSNumber*)shouldOverrideLoad:(WKNavigationAction*)navigationAction {
     return nil;
 }
 
+- (PluginURLAuthChallenge* _Nullable)handleWKWebViewURLAuthenticationChallenge:(NSURLAuthenticationChallenge* _Nonnull)challenge {
+    return nil;
+}
+
 @end
 

ios/Capacitor/Capacitor/PluginURLAuthChallenge.swift

@@ -0,0 +1,9 @@
+@objc public class PluginURLAuthChallenge: NSObject {
+    public var disposition: URLSession.AuthChallengeDisposition = .performDefaultHandling
+    public var credential: URLCredential?
+
+    public init(disposition: URLSession.AuthChallengeDisposition, credential: URLCredential?) {
+        self.disposition = disposition
+        self.credential = credential
+    }
+}

ios/Capacitor/Capacitor/WebViewDelegationHandler.swift

@@ -161,6 +161,27 @@ open class WebViewDelegationHandler: NSObject, WKNavigationDelegate, WKUIDelegat
         webView.reload()
     }
 
+    open func webView(_ webView: WKWebView, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping @MainActor (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
+        guard let bridge = bridge else {
+            completionHandler(.rejectProtectionSpace, nil)
+            return
+        }
+
+        for pluginObject in bridge.plugins {
+            let plugin = pluginObject.value
+            let selector = NSSelectorFromString("handleWKWebViewURLAuthenticationChallenge:")
+            if plugin.responds(to: selector) {
+                if let response = plugin.handleWKWebViewURLAuthenticationChallenge(challenge) {
+                    completionHandler(response.disposition, response.credential)
+                    return
+                }
+            }
+        }
+
+        completionHandler(.rejectProtectionSpace, nil)
+        return
+    }
+
     // MARK: - WKScriptMessageHandler
 
     open func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) {