When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.
More information
.png){kind=logo}
Hi @Dulob584278 (Community Member) ,
Veracode Static Analysis will report CWE 297 Improper Validation of Certificate with Host Mismatch when it can see that a credential is provided to the completionHandler that sets serverTrust.
This is typically done to ignore any errors related to TLS and may allow an attacker to pretend to be the destination of the URL if they are able to execute a Man In The Middle attack.
We recommend removing this code. Please note that ".performDefaultHandling" will ignore any credential provided so the code relating to the credential and it's setup can safely be removed.
Thank you,
Boy Baukema
Thanks for the reply. Just to make sure I properly understand the response above. Does it mean that the following code will report CWE 297?
let credential: URLCredential = URLCredential(trust: serverTrust)
completionHandler(.useCredential, credential)
I would like a clarification here as well. Will ANY call to
completionHandler(.useCredential, credential)
trigger a flaw?