[Webkit-unassigned] [Bug 187158] New: ENHANCEMENT REQUEST(iOS 11.4): Add support 3rd Party Certificate Pinning to WKWebView

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=187158

            Bug ID: 187158
           Summary: ENHANCEMENT REQUEST(iOS 11.4): Add support 3rd Party
                    Certificate Pinning to WKWebView
           Product: WebKit
           Version: Safari 11
          Hardware: iPhone / iPad
                OS: iOS 11
            Status: NEW
          Severity: Blocker
          Priority: P2
         Component: Platform
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: rob.sturtz at workday.com

The majority of Workday customers are configured to use multi-factor authorization which requires leaving the Workday app to go to Duo or a similar authorization app. Workday would like to migrate to WKWebView in place of our current UIWebView implementation, however, some Workday customers are very security conscious and require the use of 3rd party certificate pinning. This is something that is currently only available with UIWebView. Since the roll out of iOS 11.3, we have been receiving an increasing number of customer support cases that end users cannot successfully complete two factor authentication since UIWebView controller no longer supports maintaining an active connection. This is something that Duo WebView (and other mutlifactor authentication providers) use to look for confirmation of authentication. 

We are requesting Apple to add support for 3rd party certificate pinning to WKWebView. We cannot migrate to WKWebView until support is added, as it would prevent some of our customers from being able to login unless they were to compromise their security policies, which from our customer’s perspective is not a viable option.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180628/16855ed6/attachment.html>