Skip to content

Commit c19cbe2

Browse files
chrisbobbegnprice
authored andcommitted
ios docs: Add "Sign in with Apple" and NSAppTransportSecurity sections.
1 parent c7b37e2 commit c19cbe2

File tree

1 file changed

+84
-0
lines changed

1 file changed

+84
-0
lines changed

docs/howto/ios-tips.md

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,3 +84,87 @@ It seems like there's some caching strategy to avoid fetching
8484
`.podspec` files unnecessarily, potentially with network requests.
8585
(See
8686
[discussion](https://chat.zulip.org/#narrow/stream/243-mobile-team/topic/.23M3548.20RN.20v0.2E60.2E0.20upgrade/near/896746).)
87+
88+
## Sign in with Apple
89+
90+
To set up your [development server](./dev-server.md) to use Apple
91+
authentication ("Sign in with Apple"), you'll want to follow almost
92+
[these
93+
steps](https://zulip.readthedocs.io/en/latest/production/authentication-methods.html#sign-in-with-apple),
94+
but with a few things to keep in mind:
95+
96+
- If you don't have your own Apple Developer account (there's an
97+
annual fee), please ask Greg to set up test credentials and send
98+
them to you.
99+
These will be associated with the Kandra team, so
100+
[please](https://chat.zulip.org/#narrow/stream/3-backend/topic/apple.20auth/near/915391)
101+
let him know when you're finished with the credentials so he can
102+
revoke them. Please don't abuse them with deliberate spam, as
103+
that goes on our reputation.
104+
- Use the domain `zulipdev.com` where Apple asks for a domain;
105+
[`localhost` won't
106+
work](https://chat.zulip.org/#narrow/stream/3-backend/topic/Apple.20Auth/near/831533).
107+
On the public Internet, `zulipdev.com` resolves to `127.0.0.1`.
108+
- `127.0.0.1` (also what `localhost` points to) points to the
109+
machine you're on. When you're on a physical device, that's the
110+
device itself, not the device (your computer) that's running the
111+
dev server. So you won't be able to connect using `zulipdev.com`
112+
on a physical device.
113+
- Empirically, there's no problem using the iOS simulator on the
114+
computer running the dev server; it seems the iOS simulator shares
115+
its network interface with the computer it's running on. To use
116+
the native flow, you will be able to sign into the simulator at
117+
the "device" level just as you would on a real device.
118+
- Temporarily allow the app to access `http://zulipdev.com` as
119+
described in the section on `NSAppTransportSecurity` exceptions,
120+
below.
121+
122+
To test the native flow, which uses an Apple ID you've authenticated
123+
with in System Preferences, go to the ZulipMobile target in the
124+
project and targets list, and, under General > Identity, set the
125+
Bundle Identifier field to your development App ID (a.k.a. Bundle ID).
126+
If you've already installed a build that used the canonical Bundle
127+
Identifier, you'll see two app icons on your home screen. Be sure to
128+
open the correct one; it might be easiest to delete them both and
129+
reinstall to prevent any doubt.
130+
131+
You should now be able to enter `http://zulipdev.com:9991` (not
132+
`https://`), see the "Sign in with Apple" button, and use it
133+
successfully.
134+
135+
## Adding `http://` exceptions to `NSAppTransportSecurity` in `Info.plist`
136+
137+
If you need to connect to `http://zulipdev.com` or another host with
138+
the insecure `http://`, you'll need to tell the app to make an
139+
exception under iOS's "App Transport Security", either to allow access
140+
any host with `http://`, or just to specific domains.
141+
142+
These exceptions should never be committed to master, as there aren't
143+
any insecure domains we want to connect to in production.
144+
145+
To add an exception for the `zulipdev.com` domain, add the following
146+
in `ios/ZulipMobile/Info.plist`:
147+
148+
```diff
149+
<key>NSAppTransportSecurity</key>
150+
<dict>
151+
<key>NSExceptionDomains</key>
152+
<dict>
153+
<key>localhost</key>
154+
<dict>
155+
<key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
156+
<true/>
157+
</dict>
158+
+ <key>zulipdev.com</key>
159+
+ <dict>
160+
+ <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
161+
+ <true/>
162+
+ </dict>
163+
</dict>
164+
</dict>
165+
```
166+
167+
See
168+
[discussion](https://chat.zulip.org/#narrow/stream/243-mobile-team/topic/Apple.20ATS.20for.20debug/near/883318)
169+
for more convenient solutions if we find we have to allow this
170+
regularly.

0 commit comments

Comments
 (0)