Trusted Entitlements: produce verification failures for static endpoints with no signature#2752
Conversation
38ac509 to
124827f
Compare
f252a18 to
b110783
Compare
…int has no signature
b110783 to
163337e
Compare
| } | ||
|
|
||
| let needsNonce = self.path.needsNonceForSigning | ||
| return !needsNonce || (needsNonce && self.nonce != nil) |
There was a problem hiding this comment.
Hmm I wonder, is this part needed? In Android I'm only checking that supportsSignatureVerification is true and that entitlement verification is enabled. In that situation, we should always require a signature I think? Whether the path requires a nonce or not, shouldn't affect whether we require a signature I think.
There was a problem hiding this comment.
Oh the issue was some of the failing tests were wrong. I thought I needed this check but I don't! Fixed.
|
|
||
| private extension HTTPRequest { | ||
|
|
||
| var requiresSignature: Bool { |
There was a problem hiding this comment.
Should this also check if entitlement verification is enabled?
There was a problem hiding this comment.
That's done by the calling method. But I removed this property so it's more clear now.
| case .signature_failed_verification: | ||
| return "Signature failed verification" | ||
|
|
||
| case .signature_passed_verification: |
There was a problem hiding this comment.
I added this too like Android.
Equivalent to RevenueCat/purchases-android#1119