Presumably the two apps/companies know something about each other - otherwise what could be the possible point in trying to share a piece of data. So could app A enable deep linking via a url and then app B invokes that url with the token appended.

Search for iOS and app deep linking and url scheme.

Yes. Is there a way for the server to know the traffic has come from Apple and not a spoofer of Apple? I saw somebody post a question in the past about using Shared Web Credentials to perform basic auth, is that possible?

@Kevin Elliott A few of app extensions cannot make networks calls themselves, instead the OS makes the network call on behalf of the extension (such as the Message Filter Extension or Unwanted Communication extension). As its not the extension itself making the network call in these situations, then does that affect the situation?

@JR42abc Did you ever solve this?

Still present with 16.2

I just tried this myself with a phone that has 18.2 and wasn't able to observe it. I made an (unblocked call to the handset) in the call history it shows the number and the location of the caller. Then I blocked it (using Call Kit) and made another call, now it shows the number and below it it says "Name of app: blocked" I tried with another phone with iOS 18.3, this time blocking it before making the call, the result was the same i.e. it shows the call appears in the call log with the name of the app that blocked it. So therefore, how are you reproducing this? However one did I did notice was that if the number is blocked by the OS itself i.e. if you make a call then tap the (i) in the call history, and then tap Block Caller and then make a call, then in that case the call doesn't even appear in the call history. Something has also changed - when iOS 18 first was released, the OS posted a notification when a call was blocked by CallKit, this is no longer happening with iOS 18.2 or 18.3

The app sends/receives payloads from a server, these payloads themselves are not encrypted (beyond https), however the http header contain a custom field with a JWT (so the server can verify the app is who it says it is). This JWT contains a SHA256 hash. As this is just a small thing and not really a part of the actual send/received payloads, I'm unsure if the answer should be yes or not.

But https is encryption! Hence this question. Is that what they are asking, or something else. Xcode/iOS knows if an app is using http rather than https (try using http and you'll get errors etc.), so if it can detect it, why ask if you are using it. Therefore the question presumably means something other than https.

Here's a bit of specific code example, suppose an app extension wants to obtain the value of something in the info.plist which is in the app's bundle (rather than the extension's bundle). Can it be guaranteed that the app's bundle is always accessible/loaded etc. when being accessed from the app extension? private class func getObjectFromInfoPlist(name: String) -> Any? { var bundle = Bundle.main if bundle.bundleURL.pathExtension == "appex" { let url = bundle.bundleURL.deletingLastPathComponent().deletingLastPathComponent() if let otherBundle = Bundle(url: url) { bundle = otherBundle } } return bundle.object(forInfoDictionaryKey: name) }

@Scott Hello. Do you know how to enter a character such as this directly into the xcconfig file? UPDATED - found out how to enter unicode characters on a Mac: Go to System Settings/Keyboard, on the lhs click + and add Unicode Hex Input. Then in the Mac's tool bar at the top switch the keyboard to Unicode, then click Option + the unicode code i.e. in my case Option+2002. The key is to switch to the Unicode input keyboard first.

Thank you, however in this answer which I just found https://forums.developer.apple.com/forums/thread/767859 it says "Your main app should have messagefilter associated domains" So contradictory information?

@Rico "you can use developer mode, and directly pull the AASA from their web server." Could you explain this point further please. How does one directly pull an AASA file?

Delete me

So I discovered that in order to stop the OS saying developer mode was disabled, I had to go into the iPhone developer settings and switch on Associated Domains Development. Having to do this is an extra step that is not documented anywhere. However unfortunately it doesn't solve my larger issue, which is getting Network URL Unauthorized in the message filter extension when deferring the request to the server.