iPhone and UIWebView: Force HTTPS (rewrite URLs on

问题:

I have a web based application that uses Cocoa/CocoaTouch's UIWebView. I want (need?) to force all HTTP connections to HTTPS. Note that I am interested in forcing the initial, landing URL to HTTPS and all the intermediate fetches to HTTPS also. Motivation: New Tricks for Defeating SSL in Practice and sslstrip.

Is it possible to configure WebView to only use HTTPS? The UIWebView documentation does not even mention HTTPS. Considering Apple does not allow me to disable JavaScript in a UIWebView, I doubt I can make the configuration change on the view.

Or does the answer lie somewhere in NSURLRequest, NSURLConnection, and possibly delegate methods? I read URL Loading System Overview, and I don't see where I am able to change requests.

回答1:

If you want to change the request you can proxy UIWebView so all requests are intercepted and then replace http with https, and make the request from the proxy. One way of doing this would be to subclass NSURLCache and override the method cachedResponseForRequest.