ThePuiu Active Member Licensed User Longtime User Sep 25, 2019 #1 I'm trying to make a POST call to a server that doesn't have SSL. The message I receive is: The resource could not be loaded because the App Transport Security policy requires the use of a secure connection. Is there a possibility (as in Android) to avoid this?
I'm trying to make a POST call to a server that doesn't have SSL. The message I receive is: The resource could not be loaded because the App Transport Security policy requires the use of a secure connection. Is there a possibility (as in Android) to avoid this?
nwhitfield Active Member Licensed User Longtime User Sep 25, 2019 #2 There is a way of configuring plist settings to provide exceptions, as detailed here: https://developer.apple.com/documentation/security/preventing_insecure_network_connections (and I'm sure someone can explain how to turn them into a plist extra item in B4i), but you may end up having to justify it in App Review. Is there are really good reason for not having SSL? Are you in control of the server? Upvote 0
There is a way of configuring plist settings to provide exceptions, as detailed here: https://developer.apple.com/documentation/security/preventing_insecure_network_connections (and I'm sure someone can explain how to turn them into a plist extra item in B4i), but you may end up having to justify it in App Review. Is there are really good reason for not having SSL? Are you in control of the server?
nwhitfield Active Member Licensed User Longtime User Sep 25, 2019 #3 Oh, and here's an example of adding exceptions: https://www.b4x.com/android/forum/threads/ats-app-transport-security.74281/ Upvote 0
Oh, and here's an example of adding exceptions: https://www.b4x.com/android/forum/threads/ats-app-transport-security.74281/
ThePuiu Active Member Licensed User Longtime User Sep 25, 2019 #4 Thank you, now its working! The application I'm working on now is for a single company. It will run on their ASP server that is hosted on a service provider. Can a free SSL certificate be installed in this case? Will such a certificate correspond to the requirements of Apple? Upvote 0
Thank you, now its working! The application I'm working on now is for a single company. It will run on their ASP server that is hosted on a service provider. Can a free SSL certificate be installed in this case? Will such a certificate correspond to the requirements of Apple?
OliverA Expert Licensed User Longtime User Sep 25, 2019 #5 Looks like you can use Let's Encrypt (free SSL) with IIS (since it's an ASP server I'm guessing IIS is the web server). Instructions: https://miketabor.com/how-to-install-a-lets-encrypt-ssl-cert-on-microsoft-iis/ Note: Never used Let's Encrypt with IIS. I've used it successfully with Webmin, Apache and B4J Server on Linux. Links: https://letsencrypt.org/ http://www.webmin.com/ https://www.b4x.com/android/forum/threads/server-building-web-servers-with-b4j.37172/#content Upvote 0
Looks like you can use Let's Encrypt (free SSL) with IIS (since it's an ASP server I'm guessing IIS is the web server). Instructions: https://miketabor.com/how-to-install-a-lets-encrypt-ssl-cert-on-microsoft-iis/ Note: Never used Let's Encrypt with IIS. I've used it successfully with Webmin, Apache and B4J Server on Linux. Links: https://letsencrypt.org/ http://www.webmin.com/ https://www.b4x.com/android/forum/threads/server-building-web-servers-with-b4j.37172/#content
ThePuiu Active Member Licensed User Longtime User Sep 25, 2019 #6 Unfortunately, I only have access to the Control Panel from the IIS server. I cannot install any applications on the server. The hoster does not want to install anything on the server! Unless a $ 90 SSL certificate is paid Upvote 0
Unfortunately, I only have access to the Control Panel from the IIS server. I cannot install any applications on the server. The hoster does not want to install anything on the server! Unless a $ 90 SSL certificate is paid
OliverA Expert Licensed User Longtime User Sep 25, 2019 #7 ThePuiu said: Unless a $ 90 SSL certificate is paid Click to expand... Please note that PostString is not secure. All it does is to keep information out of the URL, which is typically logged by servers. It's still plain text that is easily snooped. You could encrypt everything yourself. If you do spent time to do the encryption though, would it cost more than $90 in development time? Update: Just noticed this post: https://www.b4x.com/android/forum/t...etween-b4i-and-an-asp-net-application.109922/. I guess you are aware of the situation and you are doing encryption on B4A. But unless you need encrypted info at rest, was writing your own encryption handling for data in transit cheaper than the $90 certificate? Upvote 0
ThePuiu said: Unless a $ 90 SSL certificate is paid Click to expand... Please note that PostString is not secure. All it does is to keep information out of the URL, which is typically logged by servers. It's still plain text that is easily snooped. You could encrypt everything yourself. If you do spent time to do the encryption though, would it cost more than $90 in development time? Update: Just noticed this post: https://www.b4x.com/android/forum/t...etween-b4i-and-an-asp-net-application.109922/. I guess you are aware of the situation and you are doing encryption on B4A. But unless you need encrypted info at rest, was writing your own encryption handling for data in transit cheaper than the $90 certificate?
ThePuiu Active Member Licensed User Longtime User Sep 25, 2019 #8 OliverA said: Please note that PostString is not secure. Click to expand... Yes, I know that. I have to work with the client's requirements! ASP encryption and decryption are simple, the entire encryption-decryption process took half an hour (between B4A and ASP)! Upvote 0
OliverA said: Please note that PostString is not secure. Click to expand... Yes, I know that. I have to work with the client's requirements! ASP encryption and decryption are simple, the entire encryption-decryption process took half an hour (between B4A and ASP)!
OliverA Expert Licensed User Longtime User Sep 25, 2019 #9 ThePuiu said: Yes, I know that. Click to expand... Yeah, I realized that after seeing your other iOS post. Check out your iOS post for a possible solution. ThePuiu said: entire encryption-decryption process took half an hour (between B4A and ASP)! Click to expand... Not bad. Upvote 0
ThePuiu said: Yes, I know that. Click to expand... Yeah, I realized that after seeing your other iOS post. Check out your iOS post for a possible solution. ThePuiu said: entire encryption-decryption process took half an hour (between B4A and ASP)! Click to expand... Not bad.
