Menu
Apple has announced that NSAllowArbitraryLoads will not work soon. Therefore, in iOS 10, I have this in my info.plist:
<key>NSAppTransportSecurity</key>
<dict>
<key>NSExceptionDomains</key>
<dict>
<key>myAPIdomain</key>
<dict>
<key>NSIncludesSubdomains</key>
<true/>
<key>NSExceptionAllowsInsecureHTTPLoads</key>
<true/>
</dict>
</dict>
<key>NSAllowsArbitraryLoadsInWebContent</key>
<true/>
</dict>
This works for my API request and content in UIWebView. However, in iOS9, NSAllowsArbitraryLoadsInWebContent is not supported and it is recommended to include NSAllowsArbitraryLoads for iOS 9 support. But I think this will override my NSExceptionDomains settings? How can I make HTTP requests for my API and UIWebView work on both iOS 9 and iOS 10 and still following Apple's rule?
Edit
For supporting iOS 9 and iOS 10:
<key>NSAppTransportSecurity</key>
<dict>
<key>NSExceptionDomains</key>
<dict>
<key>myAPIdomain</key>
<dict>
<key>NSIncludesSubdomains</key>
<true/>
<key>NSExceptionAllowsInsecureHTTPLoads</key>
<true/>
</dict>
</dict>
<key>NSAllowsArbitraryLoadsInWebContent</key>
<true/>
<key>NSAllowsArbitraryLoads</key>
<true/>
</dict>
774
App Transport Security (ATS) is a privacy feature introduced in iOS 9. It's enabled by default for new apps and enforces secure connections.
On Apple platforms, a networking feature called App Transport Security (ATS) improves privacy and data integrity for all apps and app extensions. ATS requires that all HTTP connections made with the URL Loading System—typically using the NSURLSession class—use HTTPS.
Must-read security coverageCurrently, Apple recommends that iOS apps use ATS, but it isn't required. By making the use of ATS, and thus encrypted web traffic through HTTPS, Apple is strengthening its stand for privacy that it garnered headlines for when it refused to unlock an iPhone for the FBI.
A Boolean value indicating whether App Transport Security restrictions are disabled for all network connections.
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key>
<true/>
</dict>
You can use the above condition if you don't want to support https(TLS 1.2). But you have to make sure it will be a temporary fix. From earlier 2017 Apple make https (TLS 1.2) as mandatory
122
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
