# Question about iOS app security

**URL:** <https://discourse.mitmproxy.org/t/question-about-ios-app-security/816>\
**Category:** help\
**Created:** [January 26, 2018, 8:47pm UTC](https://discourse.mitmproxy.org/t/question-about-ios-app-security/816 "2018-01-26T20:47:23Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cyberbeni](https://avatars.discourse-cdn.com/v4/letter/c/8c91f0/32.png) [@Cyberbeni](https://discourse.mitmproxy.org/u/Cyberbeni)\
**Post date:** [January 26, 2018, 8:47pm UTC](https://discourse.mitmproxy.org/t/question-about-ios-app-security/816/1 "2018-01-26T20:47:24Z")

</div>

Our app has certificate pinning but if either the authentication method or the host is different, we just choose to let the system handle the approval of the challenge. Is it possible to ask for an authentication method other than NSURLAuthenticationMethodServerTrust that would get accepted by the system or send a valid 301 response or exploit this in any other way?