Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

App Transport Security issue in iOS 9 and iOS 10

Tags:

ios

Apple has announced that NSAllowArbitraryLoads will not work soon. Therefore, in iOS 10, I have this in my info.plist:

<key>NSAppTransportSecurity</key>
    <dict>
        <key>NSExceptionDomains</key>
        <dict>
            <key>myAPIdomain</key>
            <dict>
                <key>NSIncludesSubdomains</key>
                <true/>
                <key>NSExceptionAllowsInsecureHTTPLoads</key>
                <true/>
            </dict>
        </dict>
        <key>NSAllowsArbitraryLoadsInWebContent</key>
        <true/>
    </dict>

This works for my API request and content in UIWebView. However, in iOS9, NSAllowsArbitraryLoadsInWebContent is not supported and it is recommended to include NSAllowsArbitraryLoads for iOS 9 support. But I think this will override my NSExceptionDomains settings? How can I make HTTP requests for my API and UIWebView work on both iOS 9 and iOS 10 and still following Apple's rule?

Edit

For supporting iOS 9 and iOS 10:

<key>NSAppTransportSecurity</key>
        <dict>
            <key>NSExceptionDomains</key>
            <dict>
                <key>myAPIdomain</key>
                <dict>
                    <key>NSIncludesSubdomains</key>
                    <true/>
                    <key>NSExceptionAllowsInsecureHTTPLoads</key>
                    <true/>
                </dict>
            </dict>
            <key>NSAllowsArbitraryLoadsInWebContent</key>
            <true/>
            <key>NSAllowsArbitraryLoads</key>
            <true/>
        </dict>
like image 774
chengsam Avatar asked Oct 27 '16 09:10

chengsam


People also ask

What is App transport security iOS?

App Transport Security (ATS) is a privacy feature introduced in iOS 9. It's enabled by default for new apps and enforces secure connections.

What is App transport security in iOS Swift?

On Apple platforms, a networking feature called App Transport Security (ATS) improves privacy and data integrity for all apps and app extensions. ATS requires that all HTTP connections made with the URL Loading System—typically using the NSURLSession class—use HTTPS.

Do all iOS apps use HTTPS?

Must-read security coverageCurrently, Apple recommends that iOS apps use ATS, but it isn't required. By making the use of ATS, and thus encrypted web traffic through HTTPS, Apple is strengthening its stand for privacy that it garnered headlines for when it refused to unlock an iPhone for the FBI.

What is Nsallowsarbitraryloads?

A Boolean value indicating whether App Transport Security restrictions are disabled for all network connections.


1 Answers

<key>NSAppTransportSecurity</key>
    <dict>
        <key>NSAllowsArbitraryLoads</key>
        <true/>
    </dict>

You can use the above condition if you don't want to support https(TLS 1.2). But you have to make sure it will be a temporary fix. From earlier 2017 Apple make https (TLS 1.2) as mandatory

like image 122
Yogesh Mv Avatar answered Oct 10 '22 05:10

Yogesh Mv