IdentityServer4与iOS9.3.5设备（禁用JavaScript）客户端兼容问题求助

Hey Aaron, sorry to hear you're stuck with this frustrating issue—older iOS versions like 9.3.5 have a bunch of quirky WebKit and protocol limitations that often clash with modern auth flows. Let’s walk through some targeted checks and fixes that might resolve your problem, even if you’ve tried general troubleshooting steps already:

Key Areas to Investigate #

1. TLS & Encryption Suite Compatibility #

iOS 9.3.5’s Safari has strict limits on TLS versions and encryption suites. Even though it supports TLS 1.2, many modern servers disable older suites that iOS 9 relies on.

• Check your IdentityServer4 host’s TLS configuration: Ensure it enables TLS 1.0/1.1 alongside 1.2 (as a temporary test) and uses encryption suites compatible with iOS 9—avoid newer ones like GCM-based suites that aren’t supported.
• Verify your SSL certificate is signed with a root CA that’s trusted by iOS 9.3.5 (some newer CAs aren’t included in older iOS trust stores).

2. Hybrid Flow Specific Configuration Quirks #

Hybrid flow’s combination of code and id_token responses can trigger bugs in iOS 9’s WebKit:

• Test switching to the Authorization Code Flow temporarily (without the id_token in the initial response). If this works, the issue is likely tied to how iOS 9 handles the hybrid response payload.
• Adjust your client’s response mode: Try using code token instead of code id_token to see if the token handling behaves differently.
• Double-check your redirect_uri configuration: Ensure it’s an exact match between your MVC client and IdentityServer4, and avoid using localhost if testing on a physical iPad (use a local network domain instead).

3. WebKit Storage & Cookie Limitations #

iOS 9 imposes strict limits on third-party cookies and browser storage, which are critical for Hybrid flow’s state/nonce persistence:

• Disable any third-party cookie blocking in the iPad’s Safari settings (go to Settings > Safari > Block Cookies, set to "Allow from Websites I Visit").
• Check if your MVC client relies on sessionStorage or localStorage to store state/nonce values—iOS 9 has smaller storage limits, so try switching to server-side session storage for these values instead.

4. IdentityServer4 2.1.1 Specific Bugs #

Version 2.1.1 is quite old (released in 2018), and there were known issues with older iOS versions in early IdentityServer4 releases:

• Enable verbose logging in IdentityServer4 (set Logging.LogLevel.IdentityServer4 to Debug in your appsettings) and look for errors related to nonce validation, token signing, or redirect handling when the iPad connects.
• If possible, test with a newer minor version of IdentityServer4 2.x (like 2.5.4) to see if the issue was fixed in a patch—many compatibility bugs were resolved in later 2.x releases.

5. PostMessage & Iframe Issues #

Hybrid flow often uses cross-domain iframes for token retrieval, and iOS 9’s WebKit has well-documented bugs with postMessage in iframes:

• If your MVC client uses iframe-based token refresh, try disabling it temporarily and test a full re-authentication flow.
• Ensure any iframe code includes fallback logic for older browsers—iOS 9 may not handle certain postMessage payload formats correctly.

Next Steps for Debugging #

If none of the above fixes work, grab more details to narrow it down:

• Use a tool like Charles Proxy to capture the full auth flow traffic from the iPad. Look for failed requests, 4xx/5xx errors, or malformed responses from IdentityServer4.
• Share any error messages from your MVC client’s logs or the iPad’s Safari console (you can enable web inspector on the iPad and connect to a Mac to view console logs).

Let me know what you find—I’m happy to help dig deeper!

内容的提问来源于stack exchange，提问作者Aaron