Per App Web Content Filter - No NEFilterBrowserFlow?

Question

Created Aug ’23

Replies 4

Boosts 0

Participants 2

Since iOS 16 it is possible to use content filter on managed apps instead of supervised devices using the new ContentFilterUUID attribute. I built a simple test project for this and found that even when targeting browser apps, no flow in the data filter is NEFilterBrowserFlow and thus can be remediated with a blocking page. All received flows are socket flows. When changing the configuration via NEFilterManager to filterSockets=false and filterBrowsers=true nothing passes through the content filter. Is this by design? is there no way to show blocking pages using per app content filter?

Boost

Answer 1

Systems Engineer OP

Apple

Aug ’23

it is possible to use content filter on managed apps instead of supervised devices

What specifically do you have going that you have managed applications without a supervised device? And are you loading a browser application as a MDM managed app?

0

Answer 2

aviads OP

Aug ’23

We are aiming to provide network security (e.g., pishing, malicious sites). While this can be done on Safari via Safari extension, it requires managed app solutions for third party browsers. Supervised device restriction is too much for most users, but many of our customers have MDM so managed apps are ok. Unfortunately, when testing it on managed apps (chrome, firefox) we don't get any NEFilterBrowserFlows, so we can't show a blocking page. Is someone checked this? seems weird that content filter can't show a blocking page only drop a connection.

0

Answer 3

Systems Engineer OP

Apple

Aug ’23

Supervised device restriction is too much for most users, but many of our customers have MDM so managed apps are ok

Referring back to TN3134, for anything below iOS 16 you'll need to have a supervised device for Content Filters.

0

Answer 4

aviads OP

Aug ’23

True, but we aim for iOS 16 and above. Checking on both iOS 16 and iOa 17 beta with per app content filter we get no browser flow at all, which prevents us from using remediation to show a blocking screen and thus are kinda useless.

0