如何在嵌入式WebView中显示HTTPS请求的证书
在我的 Mac OS X 应用程序中，我使用嵌入式 WebView 为不同的服务进行 OAuth 登录。其中大多数使用 HTTPS 请求来获取 Web 视图中显示的授权表单。
现在我需要在连接安全后立即显示一个小锁，就像在 Safari 中一样。单击该锁应打开一个 SFCertificatePanel，其中显示用于该请求的证书。
这可以在 OS X 的 WebView 中完成吗？我检查了所有代表，但没有找到发送给他们的可用消息来显示该锁定图标或获取证书。
感谢您的帮助！
In my Mac OS X app I'm using an embedded WebView to do OAuth logins for different services. Most of them use a HTTPS request for the authorization form that's displayed in the WebView.
Now I need to display a small lock like in Safari, as soon as the connection is secure. A click on that lock should open a SFCertificatePanel that displays the certificate used for that request.
Can that be done in WebView for OS X? I checked all delegates but didn't find a usable message sent to them to display that lock-icon or to get the certificate.
Thanks for your help!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
对我来说，这听起来是一个相当可疑的想法。考虑到可能的用户行为和用户理解（例如，用户对安全性的心理模型），我怀疑它在实践中并不安全。
这是核心问题。您的应用程序窗口中没有任何位置可以显示用户可以信任的锁，并且用户会理解并知道它是不可欺骗的，并且用户知道要集中注意力。恶意网站很容易在其页面上包含锁定图标的图像，这可能会欺骗用户，让他们认为已使用 HTTPS，而实际上并未使用。恶意网站甚至可以使图标可点击，如果用户点击它，就会弹出欺骗性的证书信息。大多数用户不希望检测到此类攻击。
相反，如果您知道某个特定站点需要使用 HTTPS，我建议您使用
https://URL 加载原始 URL。由于您指定了要在 WebView 中加载的 URL，因此您知道它将使用 SSL。据我所知，这实际上是您在应用程序中可以做的最好的事情。至少，鉴于此处指定的问题描述，我想不出更好的方法。This sounds like a pretty dubious idea to me. I suspect it would not be secure in practice, given likely user behavior and user understanding (e.g., the mental models that users have about security).
Here's the core problem. There is no place in your app window to display a lock that users can trust, and that users will understand and know is unspoofable, and that users know to focus their attention on. It would be too easy for a malicious website to include an image of a lock icon on their page, and this might fool users into thinking that HTTPS has been used when it actually hasn't. The malicious website could even make the icon clickable, and if the user clicks on it, have spoofed certificate information pop up. Most users would have no hope of detecting such an attack.
Instead, if you know that a particular site needs to use HTTPS, I suggest that you load the original URL using a
https://URL. Since you specified the URL to be loaded in the WebView, you know that it will be using SSL. As far as I know, that's realistically about the best you can do from within your app. At least, I can't think of anything better, given the problem description specified here.