49 lines
1.9 KiB
Swift
49 lines
1.9 KiB
Swift
//
|
|
// HTTPSDowngradeGuard.swift
|
|
//
|
|
// Copyright 2026 Brendan Szymanski <hello@bscubed.dev>
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
//
|
|
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
//
|
|
|
|
import Foundation
|
|
|
|
#if canImport(FoundationNetworking)
|
|
import FoundationNetworking
|
|
#endif
|
|
|
|
/// Prevents an HTTPS connection probe from silently following a redirect to HTTP.
|
|
final class HTTPSDowngradeGuard: NSObject, URLSessionTaskDelegate, Sendable {
|
|
/// Decides whether a redirect preserves transport security.
|
|
///
|
|
/// - Parameters:
|
|
/// - session: The URL session handling the redirect.
|
|
/// - task: The task receiving the redirect.
|
|
/// - response: The response that requested the redirect.
|
|
/// - request: The proposed redirected request.
|
|
/// - completionHandler: Receives the request to follow, or `nil` to reject it.
|
|
func urlSession(
|
|
_ session: URLSession,
|
|
task: URLSessionTask,
|
|
willPerformHTTPRedirection response: HTTPURLResponse,
|
|
newRequest request: URLRequest,
|
|
completionHandler: @escaping (URLRequest?) -> Void
|
|
) {
|
|
let from = response.url?.scheme?.lowercased()
|
|
let to = request.url?.scheme?.lowercased()
|
|
completionHandler(from == "https" && to == "http" ? nil : request)
|
|
}
|
|
}
|