Cordova是否支持在iOS上鎖定證書？

Question

Cordova是否支持在iOS上鎖定證書？

Answer 1

Cordova不支持證書鎖定，但可以使用Intel App Security API作爲Cordova plugin來實現。

安全傳輸與固定公鑰發送片段：該片段的

// TODO change server PK 
var publicKey = "-----BEGIN PUBLIC KEY-----\n" + 
    "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD99BcjGlZ+W988\n" + 
    "bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdqfnGk5sRgprDv\n" + 
    "gOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDviS2Aelet8u5f\n" + 
    "a9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU1XupGc1V3sjs\n" + 
    "0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+bw8HHa8sHo9g\n" + 
    "OeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoWMPRfwCvocWvk\n" + 
    "+QIDAQAB\n" + 
    "-----END PUBLIC KEY-----\n"; 

// create the Transport Secure instance 
intel.security.secureTransport.open({url: "https://software.intel.com/en-us/app-security-api/api", serverKey: publicKey}) 

// send the request 
.then (function (transportInstanceID) { 
     // send the HTTPS request 
     return intel.security.secureTransport.sendRequest({instanceID: transportInstanceID, requestBody: "data to send"}); 
}) 

// process the response 
.then (function(response) { 
    // assign response HTTP status 
    var responseHttpStatus = response.responseHttpStatus; 

    // assign response body 
    var responseBody = response.responseBody; 

    // assign response header 
    var responseHeader = response.responseHeader; 

    // now we have the following items: 
    // the response status in 'responseHttpStatus' 
    // the response body in 'responseBody' 
    // the response header in 'responseHeader' 

    // we can use those in our code. 
    doSomethingAfterReceiveWithKeyPinning(response); 
}) 

.catch (function(error) { 
    console.log("Fail, error code is: " + error.code + ", error message is: " + error.message); 
}); 

來源是從原來的文檔：https://software.intel.com/en-us/node/604523

Answer 2

科爾多瓦沒有，但像大多數功能一樣，可以使用插件。

「用於與HTTP服務器通信的Cordova/Phonegap插件允許SSL固定！」 - https://github.com/wymsee/cordova-HTTP

就像他在Cordova Security Guide中所說的那樣，「......假設你的應用能夠使用插件完成所有的網絡請求（即：沒有傳統的XHR/AJAX請求等）。」