Filtering traffic by URL with OHTTP Gateway

Question

Created 4d

Replies 2

Boosts 0

Participants 2

Hello, I am developing a URL traffic filtering system.

I’ve set up a PIR server following this guide: https://developer.apple.com/documentation/networkextension/setting-up-a-pir-server-for-url-filtering

According to this WWDC25 video, it appears that I need to use an OHTTP Gateway: https://developer.apple.com/videos/play/wwdc2025/234/

So, I developed an OHTTP Gateway and verified it using a test client.

Following that, I built the app and installed it on a test iPhone based on this sample: https://developer.apple.com/documentation/networkextension/filtering-traffic-by-url

However, I cannot find any settings related to the OHTTP URL within this sample.

How should I proceed with the OHTTP configuration in this case?

Thank you.

Answered by DTS Engineer in 882233022

using an OHTTP Gateway requires an OHTTP Relay to function correctly

The story here depends on where you’re at in your development. During bring up, you don’t need to mess around with OHTTP. When you go to deploy [1], you’ll need to onboard with Apple’s OHTTP relay. See How to onboard with an Oblivious HTTP relay hosted by Apple.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] To be clear, that includes Ad Hoc distribution and TestFlight. The critical factor here is the get-task-allow entitlement, which is set to true for development-signed code and false (or missing) for distribution-signed code.

Boost

Answer 1

rkasud0 OP

4d

Additional Questions:

As I understand it, using an OHTTP Gateway requires an OHTTP Relay to function correctly. Is this correct?

If so, is it possible to test URL Filtering with a PIR Server directly through the OHTTP Gateway, bypassing the Relay for testing purposes?

Thank you.

0

Answer 2

DTS Engineer OP

Apple

1d

Recommended

using an OHTTP Gateway requires an OHTTP Relay to function correctly

The story here depends on where you’re at in your development. During bring up, you don’t need to mess around with OHTTP. When you go to deploy [1], you’ll need to onboard with Apple’s OHTTP relay. See How to onboard with an Oblivious HTTP relay hosted by Apple.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] To be clear, that includes Ad Hoc distribution and TestFlight. The critical factor here is the get-task-allow entitlement, which is set to true for development-signed code and false (or missing) for distribution-signed code.

0