iOS

Introduction

The SDK supports both programmatic integration, and no-code auto-sign approach (if your app uses the NSURLRequest networking API, or any of the wrappers, like Alamofire, Moya, FSNetworking, or SwiftHTTP). The SDK does not currently support tvOS or watchOS.

These instructions assume that you have already read the Developer Guide. If you have not yet done so, please do so before continuing below.

This SDK comes with examples: two full Xcode projects are enclosed, one was written in Swift, another in Objective-C. You can play with these examples to understand how SDK integration works.

In the recent versions of Xcode, Enable Bitcode option is ON by default. This is not required for iOS apps. The bitcode option is not fully supported in Reblaze Mobile SDK. To use the Mobile SDK in your application, you must disable bitcode when you export the application for App Store distribution.

Installation

Using CocoaPods

Run the pod install to receive the workspace that has the Reblaze Mobile SDK integrated. Your Podfile should include:

use_frameworks!
pod 'Reblaze', :path => '${ReblazeSDK_root}/libs/iOS'

Include the ReblazeSDK framework manually

• Drag libs/iOS/ReblazeSDK.xcframework to your project in the Project Navigator.

• Select your project and then your app target. Open the General panel.

• In Frameworks, Libraries and Embedded Content add ReblazeSDK.xcframework and mark as Embed and Sign.

Finding the app Signature

Your backendUrl points to your application server, protected by Reblaze Web Proxy. You must configure this Web Proxy to recognize the signature of your app. To find the signature of your app, you can open the Apple Development Certificate in the Keychain app, and copy the SHA-256 fingerprint. Alternatively, you can extract this fingerprint from the ipa bundle. Uploading it to Reblaze Console, make sure that it contains hexadecimal characters only, in lowercase, without spaces.

During testing, you may allow running the app on Simulator. The simulator generates a special signature: "abadbabe". Note that you can also use Offline Testing both on Simulator and on a physical device.

There is a protocol between the SDK and the backend that negotiates the signature remotely and notifies the system of a new one, if such was generated. The communication between the components takes place under the /74d8-ffc3-0f63-4b3c-c5c9-5699-6d5b-3a1f endpoint, and when a new signature is introduced, it will be provided as a value for the header named "sig" (see screenshot below). This new signature shall then be added to the app signatures list under the Mobile SDK settings in Reblaze Console. To find it easily in the View Log, use this filter:

url:/74d8-ffc3-0f63-4b3c-c5c9-5699-6d5b-3a1f

The 'sig' header value is the new encountered signature

Initialization

We recommend to configure the SDK by adding the ReblazeSDK string to iOS app Info.plist. This guarantees that the SDK will become activated as early as possible, sets autoSign and takes advantage of remote configuration.

If you want to configure the SDK programmatically, the best choice would be to configure the SDK in application:didFinishLaunchingWithOptions: method.

To access the SDK in your code, you must import ReblazeSDK as follows:

Swift

import ReblazeSDK

Objective-C

@import ReblazeSDK;

Note that autoSign may be turned ON and OFF at any time, and this property is subject to remote configuration override.

Auto-signing and WebView

‌You can pass the rbzsdk header with a request that returns an HTML that you load into a WebView. But this approach does not support the links and resources (including AJAX) that are parts of that HTML. To handle these use cases, the Mobile SDK for iOS introduces auto-signing.

The SDK automatically signs all relevant requests as long as the application needs this. This applies not only to requests that originate in the WebView, but to all requests (based on NSURLRequest networking API, or any of the wrappers, like Alamofire, Moya, FSNetworking, or SwiftHTTP) that point to the designated backend. There is no collision if some request is signed programmatically.

While debugging the application, all auto-signed requests will be reported to your listener (see Monitoring the SDK.

Auto-signing could be abused by malicious actors if they can achieve hostile takeover of your app. That's why we strongly recommend that all our customers apply obfuscation and runtime protection techniques for their apps.

To reduce the attack surface, you may choose to turn auto-signing on only while a relevant WebView is active.