[Webkit-unassigned] [Bug 184791] New: REGRESSION(iOS 11.3; IMPACTING 100% WORKDAY MULTI-FACTOR AUTH USERS) - UIWebview drops connections when the app is backgrounded

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=184791

            Bug ID: 184791
           Summary: REGRESSION(iOS 11.3; IMPACTING 100% WORKDAY
                    MULTI-FACTOR AUTH USERS) - UIWebview drops connections
                    when the app is backgrounded
           Product: WebKit
           Version: Safari 11
          Hardware: iPhone / iPad
                OS: iOS 11
            Status: NEW
          Severity: Blocker
          Priority: P2
         Component: New Bugs
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: jeremy.bassi at workday.com

The majority of Workday customers are configured to use multi-factor authorization which requires leaving the Workday app to go to Duo or a similar authorization app. 

In previous versions of iOS (< iOS 11.3) when UIWebView was loaded in the Workday for Duo login and the user must background Workday to tap the authorization button in Duo before returning to Workday, the UIWebView controller supported maintaining an active connection which the Duo WebView would poll to look for confirmation of authentication. With iOS 11.3, the UIWebView controller no longer supports maintaining a connection when the app is backgrounded (https://openradar.appspot.com/39508158). Specifically, the WebView does not have the ability to refresh itself to determine that authentication is granted. 

We are also unable to switch to using WKWebView controller because it does not support 3rd party certificate pinning which is a security requirement for Workday customers. 

Please reference https://openradar.appspot.com/39508158 which already has a test app attached. 

We are also in the process of creating a test app and will update this ticket as soon as we have that test app ready for submission.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180419/83c5338d/attachment.html>