cordova-plugin-except-aws-s3-from-ats
Advanced tools
Cordova plugin that excepts access to S3 from App Transport Security (iOS9)
Cordova plugin that excepts access to S3 from App Transport Security (iOS9)
iOS9 introduced strict transport security rules (ATS) which rejects the current S3 certificates. This blocks all
access from Cordova based apps to AWS S3, e.g. won't load.
AWS recommends to except the S3 domain via the -Info.plist (link):
Recent changes, per Apple�s App Transport Security Technote, states using NSURLConnection, CFURL, or NSURLSession require TLS 1.2 and SHA256 (or > better) signed hash algorithms. S3 currently supports TLS 1.2. S3 endpoint certificates will continue to be based on SHA-1 until September 30th. We recommend specifying exceptions to the default ATS behavior by modifying the Info.plist file during the transition period. Later this year, when S3 SHA-256 certificates are deployed, we recommend testing and confirming your application works properly with the enabled ATS security settings.
All current apps will continue to function just fine. This applies specifically to those that are compiled with the new SDK, Xcode 7.
This plugin adds the required entry to -Info.plist.
FAQs
Cordova plugin that excepts access to S3 from App Transport Security (iOS9)
We found that cordova-plugin-except-aws-s3-from-ats demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Rustâs crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.
Security News
/Research
Socket found a Rust typosquat (finch-rust) that loads sha-rust to steal credentials, using impersonation and an unpinned dependency to auto-deliver updates.
Research
/Security Fundamentals
A pair of typosquatted Go packages posing as Googleâs UUID library quietly turn helper functions into encrypted exfiltration channels to a paste site, putting developer and CI data at risk.
