iOS平台Flutter企业应用WebView的mTLS认证与自定义User-Agent问题

一、基于flutter_inappwebview的实现方案 #

1. 配置Keychain访问权限 #

首先在iOS项目的Info.plist中添加Keychain访问配置，确保应用能读取MDM部署的证书：

<key>keychain-access-groups</key>
<array>
  <string>$(AppIdentifierPrefix)com.yourcompany.yourapp</string>
  <!-- 若MDM证书有专属访问组，需额外添加对应组 -->
</array>

同时在Xcode的「Capabilities」中开启「Keychain Sharing」功能。

2. 原生层获取Keychain中的证书与身份信息 #

通过Swift代码从Keychain筛选MDM部署的客户端证书，并关联对应的私钥生成SecIdentity（需封装为Flutter MethodChannel供Dart调用）：

import Security

// 获取符合条件的客户端证书
func getClientCertificates() -> [SecCertificate]? {
    let query: [CFString: Any] = [
        kSecClass: kSecClassCertificate,
        kSecAttrCertificateType: kSecAttrCertificateTypeX509,
        kSecReturnRef: kCFBooleanTrue!,
        kSecMatchLimit: kSecMatchLimitAll
    ]
    
    var result: AnyObject?
    let status = SecItemCopyMatching(query as CFDictionary, &result)
    
    guard status == errSecSuccess, let certificates = result as? [SecCertificate] else {
        return nil
    }
    
    // 根据MDM证书的颁发者/主题筛选，替换为实际匹配规则
    return certificates.filter { cert in
        let issuer = SecCertificateCopyIssuerSummary(cert) as String?
        return issuer?.contains("Your-MDM-Issuer-Name") ?? false
    }
}

// 通过证书获取对应的SecIdentity（含私钥）
func getIdentityForCertificate(_ certificate: SecCertificate) -> SecIdentity? {
    let query: [CFString: Any] = [
        kSecClass: kSecClassIdentity,
        kSecMatchCertificate: certificate,
        kSecReturnRef: kCFBooleanTrue!,
        kSecMatchLimit: kSecMatchLimitOne
    ]
    
    var result: AnyObject?
    let status = SecItemCopyMatching(query as CFDictionary, &result)
    
    return status == errSecSuccess ? result as? SecIdentity : nil
}

3. Flutter端处理证书请求并设置自定义User-Agent #

在Dart代码中，通过MethodChannel调用原生方法获取SecIdentity，并在onReceivedClientCertRequest回调中完成证书响应，同时配置自定义User-Agent：

import 'package:flutter/services.dart';
import 'package:flutter_inappwebview/flutter_inappwebview.dart';

class CertAuthWebView extends StatefulWidget {
  const CertAuthWebView({Key? key}) : super(key: key);

  @override
  State<CertAuthWebView> createState() => _CertAuthWebViewState();
}

class _CertAuthWebViewState extends State<CertAuthWebView> {
  static const MethodChannel _channel = MethodChannel('com.yourcompany/cert_auth');

  @override
  Widget build(BuildContext context) {
    return InAppWebView(
      initialUrlRequest: URLRequest(url: Uri.parse("your-idp-login-url")),
      initialSettings: InAppWebViewSettings(
        // 设置自定义User-Agent
        userAgent: "Your-App-Custom-User-Agent",
      ),
      onReceivedClientCertRequest: (controller, request, callback) async {
        // 调用原生方法获取SecIdentity
        final identity = await _channel.invokeMethod('getClientIdentity');
        // 生成证书响应并回调
        final response = ClientCertResponse.fromIdentity(identity);
        callback(response);
      },
    );
  }
}

二、原生WKWebView嵌入方案（插件不够灵活时使用） #

若flutter_inappwebview的回调存在限制，可直接用原生WKWebView实现证书认证，再通过PlatformView嵌入Flutter：

1. 原生WKWebView配置与证书处理 #

import WebKit

class CertAuthWebViewController: UIViewController, WKNavigationDelegate {
    private var webView: WKWebView!
    
    override func viewDidLoad() {
        super.viewDidLoad()
        
        let config = WKWebViewConfiguration()
        // 设置自定义User-Agent
        config.applicationNameForUserAgent = "Your-App-Custom-User-Agent"
        
        webView = WKWebView(frame: view.bounds, configuration: config)
        webView.navigationDelegate = self
        view.addSubview(webView)
        
        // 加载IdP登录页面
        if let url = URL(string: "your-idp-login-url") {
            webView.load(URLRequest(url: url))
        }
    }
    
    // 处理客户端证书请求
    func webView(_ webView: WKWebView, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodClientCertificate else {
            completionHandler(.performDefaultHandling, nil)
            return
        }
        
        // 获取证书与身份信息
        guard let certificates = getClientCertificates(), let cert = certificates.first, let identity = getIdentityForCertificate(cert) else {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        
        let credential = URLCredential(identity: identity, certificates: [cert], persistence: .forSession)
        completionHandler(.useCredential, credential)
    }
    
    // 复用之前的getClientCertificates和getIdentityForCertificate方法
    func getClientCertificates() -> [SecCertificate]? { /* ... */ }
    func getIdentityForCertificate(_ certificate: SecCertificate) -> SecIdentity? { /* ... */ }
}

2. 将原生WebView嵌入Flutter #

class NativeCertWebView extends StatelessWidget {
  const NativeCertWebView({Key? key}) : super(key: key);

  @override
  Widget build(BuildContext context) {
    return UiKitView(
      viewType: 'com.yourcompany/cert_auth_webview',
      creationParamsCodec: const StandardMessageCodec(),
    );
  }
}

同时在iOS的AppDelegate中注册PlatformView：

import Flutter

class CertAuthWebViewFactory: NSObject, FlutterPlatformViewFactory {
    private let messenger: FlutterBinaryMessenger
    
    init(messenger: FlutterBinaryMessenger) {
        self.messenger = messenger
        super.init()
    }
    
    func create(withFrame frame: CGRect, viewIdentifier viewId: Int64, arguments args: Any?) -> FlutterPlatformView {
        return CertAuthWebView(frame: frame, viewId: viewId, messenger: messenger)
    }
}

class CertAuthWebView: NSObject, FlutterPlatformView {
    private let controller: CertAuthWebViewController
    
    init(frame: CGRect, viewId: Int64, messenger: FlutterBinaryMessenger) {
        controller = CertAuthWebViewController()
        super.init()
    }
    
    func view() -> UIView {
        return controller.view
    }
}

// 在AppDelegate中注册
func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
    guard let controller = window?.rootViewController as? FlutterViewController else {
        return false
    }
    let factory = CertAuthWebViewFactory(messenger: controller.binaryMessenger)
    controller.registrar(forPlugin: "com.yourcompany/cert_auth_webview").register(factory, withId: "com.yourcompany/cert_auth_webview")
    return true
}

三、关键注意事项 #

• MDM证书权限：确保MDM部署证书时，设置的Keychain访问组与应用配置一致，否则应用无法读取证书。
• 证书筛选逻辑：需根据实际MDM证书的属性（如颁发者、主题）调整筛选规则，避免匹配无关证书。
• SSL错误排查：错误码-1200通常源于证书信任问题或客户端证书未正确提交，需确认服务器信任客户端证书的CA，且证书链完整。
• User-Agent验证：自定义User-Agent需与防火墙规则完全匹配，避免被拦截。

内容的提问来源于stack exchange，提问作者Jugal Thakkar