How to display HTTPS request certificate in embedded WebView

Question

In my Mac OS X application, I use the built-in WebView to execute OAuth logins for different services. Most of them use the HTTPS request for the login form displayed in the WebView.

Now I need to display a small lock, as in Safari, as soon as the connection is secure. Clicking on this lock should open the SFCertificatePanel , which displays the certificate used for this request.

Can this be done in WebView for OS X? I checked all the delegates but did not find a useful message sent to them to display this lock icon or receive a certificate.

Thank you for your help!

Answer 1

This sounds a rather dubious idea to me. I suspect that this would be unsafe in practice, given the likely behavior of the user and the understanding of users (for example, the mental models that users have about security).

Here is the main problem. There is no place in your application window for displaying a lock that users can trust, and that users will understand and recognize are not subject to doubt, and users know to focus their attention. It would be too easy for a malicious website to include an image of the lock icon on their page, and this could lead to users thinking that HTTPS is used when it is not really there. An malicious website can even make the icon clickable, and if the user clicks on it, information about certificate forgery will appear. Most users did not hope to detect such an attack.

Instead, if you know that a particular site should use HTTPS, I suggest you download the source URL using the https:// URL. Since you specified the URL that will be loaded into the WebView, you know that it will use SSL. As far as I know, this is real about what you can do in your application. At least I can't think of anything better, given the description of the problem described here.