App Transport Security problem with WebView-based setup

MacOSX and iOS
1

Hello,

I am building a webview-based plugin project and am getting problems on MacOS (working fine so far on Windows) specifically with the App Transport Security - it is giving me this error in the window itself:

The resource could not be loaded because the App Transport Security policy requires the use of a secure connection.

From what I’ve dug through, it seems like this is a PList issue and that modifying that file will help. The problem is that I have a whole build and release pipeline setup with CMake and GH Actions, so any manual steps like editing the PList file are out of the question. But if there is a way to handle this through CMake or just some bash commands, then that would be great.

Thank you for your help!

2

I think you could probably use PLIST_TO_MERGE in the juce_add_plugin function, something like (untested)…

juce_add_plugin(MyPlugin
    ...
    PLIST_TO_MERGE "<plist><dict>
        <key>NSAllowsArbitraryLoadsInWebContent</key><true/>
    </dict></plist>")
3

Thanks for the suggestion! I’ve added the PList merging and I can see that it is forming the .plist file correctly, but I cannot seem to figure out what exact settings I need. I’ve tried NSAllowsArbitraryLoads, NSAllowsArbitraryLoadsInWebContent. I’ve tried those both (individually) with NSAllowsLocalNetworking but it is still showing the original error about App Transport Security.

From what I was researching it also seems that you need to wrap the entry in a NSAppTransportSecurity dictionary (I just need localhost anyway):

<plist>
    <dict>
        <key>NSAppTransportSecurity</key>
        <dict>
            <key>NSAllowsLocalNetworking</key>
            <true/>
        </dict>
    </dict>
</plist>
4

I’m not sure sorry, I would have thought NSAllowsArbitraryLoads would work, that being said this stack overflow article has a suggestion to try running nscurl --ats-diagnostics <your-URL> to help you find the settings required to connect to your-URL. Maybe that will help?

5

No worries. I tried that too, and it failed on all tests, but I’m assuming that was the case just because I am only testing localhost. As soon as I find a fix I’ll come back to post it here

1 Like
6

Still haven’t fixed it yet, but have made some findings (I think):

I hadn’t implemented the SinglePageBrowser struct that’s in the tutorial, which overrides the pageAboutToLoad method. Before doing so, the Windows build was working fine and the MacOS was having the App Transport Security problem (despite trying the PList merging).

After implementing that method override, both Windows and MacOS builds just display a white screen. There’s no source files within the inspector that I can see, and the HTML content is just an empty body. I’m not able to debug using “Attach to process” (in CLion) b/c it’s on init and I can’t click that fast…

Here is my implementation (basically verbatim what’s in the tutorial minus namespace usage):

struct SinglePageBrowser : juce::WebBrowserComponent {
    using juce::WebBrowserComponent::WebBrowserComponent;

    /**
     * NOTE: Prevents page loads from navigating away from our single page web app.
     */
    bool pageAboutToLoad(const juce::String& url) override
    {
        // This conditional isn't evaluating as "true"
        return url == LOCAL_DEV_SERVER_ADDRESS || url == getResourceProviderRoot();
    }
};

Just for conciseness:

  • Windows
    • Works if I don’t implement pageAboutToLoad override or just return true
    • White screen if I implement pageAboutToLoad as directed in the tutorial
  • MacOS
    • White screen if I implement pageAboutToLoad, but commenting it out or just returning true get’s past white screen onto App Security issue
    • App Security Issue still persists depiste the PList merging

What suggestions would you have for debugging this?

7

I also noticed that the method / function declarations and definitions are slightly different. For example, there is the GetResource method declared both globally in the file and also within the editor class, but the definition is just inside the class. Why is the extra globally declared function there?

8

Well… turns out I was missing a “/” at the end of my string constant, which obviously in hindsight was causing pageAboutToLoad to always evaluate to false.

1 Like