Bug 187158 – ENHANCEMENT REQUEST(iOS 11.4): Add support 3rd Party Certificate Pinning to WKWebView

• Status: NEW
• Component: Page Loading

[Rob Sturtz]

The majority of Workday customers are configured to use multi-factor authorization which requires leaving the Workday app to go to Duo or a similar authorization app. Workday would like to migrate to WKWebView in place of our current UIWebView implementation, however, some Workday customers are very security conscious and require the use of 3rd party certificate pinning. This is something that is currently only available with UIWebView. Since the roll out of iOS 11.3, we have been receiving an increasing number of customer support cases that end users cannot successfully complete two factor authentication since UIWebView controller no longer supports maintaining an active connection. This is something that Duo WebView (and other mutlifactor authentication providers) use to look for confirmation of authentication. 

We are requesting Apple to add support for 3rd party certificate pinning to WKWebView. We cannot migrate to WKWebView until support is added, as it would prevent some of our customers from being able to login unless they were to compromise their security policies, which from our customer’s perspective is not a viable option.