{"action":"created","issue":{"url":"https://api.github.com/repos/braintree/braintree_ios/issues/94","labels_url":"https://api.github.com/repos/braintree/braintree_ios/issues/94/labels{/name}","comments_url":"https://api.github.com/repos/braintree/braintree_ios/issues/94/comments","events_url":"https://api.github.com/repos/braintree/braintree_ios/issues/94/events","html_url":"https://github.com/braintree/braintree_ios/pull/94","id":58138278,"number":94,"title":"[Bugfix] SSL Pinning should pass through unexpected authentication methods","user":{"login":"mickeyreiss","id":47405,"avatar_url":"https://avatars.githubusercontent.com/u/47405?v=3","gravatar_id":"","url":"https://api.github.com/users/mickeyreiss","html_url":"https://github.com/mickeyreiss","followers_url":"https://api.github.com/users/mickeyreiss/followers","following_url":"https://api.github.com/users/mickeyreiss/following{/other_user}","gists_url":"https://api.github.com/users/mickeyreiss/gists{/gist_id}","starred_url":"https://api.github.com/users/mickeyreiss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mickeyreiss/subscriptions","organizations_url":"https://api.github.com/users/mickeyreiss/orgs","repos_url":"https://api.github.com/users/mickeyreiss/repos","events_url":"https://api.github.com/users/mickeyreiss/events{/privacy}","received_events_url":"https://api.github.com/users/mickeyreiss/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-18T22:20:24Z","updated_at":"2015-02-18T22:39:13Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/braintree/braintree_ios/pulls/94","html_url":"https://github.com/braintree/braintree_ios/pull/94","diff_url":"https://github.com/braintree/braintree_ios/pull/94.diff","patch_url":"https://github.com/braintree/braintree_ios/pull/94.patch"},"body":"#### Background\r\n\r\nToday, there was a configuration change in sandbox that caused our HTTP client to break. In particular, the sandbox began to request [SSL client certificates](https://docs.oracle.com/cd/E19424-01/820-4811/aakhe/index.html). Our [status page](https://status.braintreepayments.com/incidents/ypbc8csb6hpk) has more details about the incident.\r\n\r\nUnfortunately, our HTTP client, `BTHTTP`, uses [SSL pinning code](https://github.braintreeps.com/braintree/braintree-ios/blob/3.5.0/Braintree/API/Networking/BTHTTP.m#L378-L389) that did not handle a challenge with this type of authentication method. Specifically, we never called the callback in \r\nour implementation of `URLSession:didReceiveChallenge:completionHandler:` when the authentication method type was anything other than `NSURLAuthenticationMethodServerTrust`. (Note the missing `else` [here](https://github.braintreeps.com/braintree/braintree-ios/blob/3.5.0/Braintree/API/Networking/BTHTTP.m#L389).)\r\n\r\n#### Resolution\r\n\r\nThe primary issue has now resolved with deployment to our sandbox API servers, reverting the SSL client certificate request.\r\n\r\nIn addition, this PR fixes our SSL pinning code to avoid the \"infinite spinning\" in case of future changes to our server-side SSL implementation.\r\n\r\nOne thing that is missing here is a test case to reproduce the specific issue, but I do not know how to add client verification to the [test HTTPS server](https://github.braintreeps.com/braintree/braintree-ios/blob/3.5.0/Specs/Braintree-API-Integration-Specs/SSL/https_server.rb)."},"comment":{"url":"https://api.github.com/repos/braintree/braintree_ios/issues/comments/74963932","html_url":"https://github.com/braintree/braintree_ios/pull/94#issuecomment-74963932","issue_url":"https://api.github.com/repos/braintree/braintree_ios/issues/94","id":74963932,"user":{"login":"mickeyreiss","id":47405,"avatar_url":"https://avatars.githubusercontent.com/u/47405?v=3","gravatar_id":"","url":"https://api.github.com/users/mickeyreiss","html_url":"https://github.com/mickeyreiss","followers_url":"https://api.github.com/users/mickeyreiss/followers","following_url":"https://api.github.com/users/mickeyreiss/following{/other_user}","gists_url":"https://api.github.com/users/mickeyreiss/gists{/gist_id}","starred_url":"https://api.github.com/users/mickeyreiss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mickeyreiss/subscriptions","organizations_url":"https://api.github.com/users/mickeyreiss/orgs","repos_url":"https://api.github.com/users/mickeyreiss/repos","events_url":"https://api.github.com/users/mickeyreiss/events{/privacy}","received_events_url":"https://api.github.com/users/mickeyreiss/received_events","type":"User","site_admin":false},"created_at":"2015-02-18T22:39:13Z","updated_at":"2015-02-18T22:39:13Z","body":"I'd recommend looking at this diff without whitespace at  https://github.com/braintree/braintree_ios/pull/94/files?w=1"}}