Added the ability to explicitly set host trust evaluation when setting pkeys for SSL pinning #46
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR introduces a new parameter
evaluateAllHostsForTrustto the initializer ofAlamofireClient. This parameter directly maps toallHostsMustBeEvaluatedin Alamofire’sServerTrustManager.Previously, this value was hardcoded to true (as default value in
ServerTrustManagerinitializer), which meant every host had to have a trust evaluator configured. This led to errors like:noRequiredEvaluator(host:). Even for hosts that weren’t meant to use SSL pinning. This made it difficult to use the client in more complex networking setups.The new parameter defaults to true to preserve backward compatibility and is safe to include in a patch release as it does not break existing behavior.
TODO:
The current implementation of SSL pinning support in this library is fairly rigid. It tightly couples the usage of
ServerTrustManagerwithPublicKeysTrustEvaluator, making it impossible to inject or configure alternative evaluators (e.g. certificate pinning, custom logic, etc.).This change improves flexibility slightly, but a larger refactor would be needed to make the SSL pinning integration truly extensible. That’s a broader topic outside the scope of this patch.