Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Application Transport Security (ATS) and app submission

Tags:

xcode

ios

ios9

I searched online extensively but could not find any concrete/official information on the following questions related to submission of an app affected by ATS.

  1. Q: ATS is applicable only on iOS 9 onward. What happens to older apps (built for iOS 8.x and below) when the device is upgraded to iOS9. Will they have ATS disabled by default or will they stop functioning if they are not ATS compliant? ANS: Apps built for lower SDKs will opt-out of ATS by default. Was able to verify this using an iOS 9 beta 5 device.(app-dev-forum link)

  2. Will applications that set the global ATS disabler flag (allowarbitraryloads) be admitted to the app store?

  3. After iOS 9 releases, can apps linking to older SDKs can still be submitted to the marketplace? Apple is currently accepting apps with deployment_sdk of iOS 5
  4. After iOS 9 releases, should apps be built with the release version of the SDK?
  5. Q: I heard that if an app is built against beta versions, it will be rejected. Please correct me if I'm wrong. ANS: Yes. Apps based on beta version of SDKs will get rejected.

Great if you can answer any of the above. I'll compile the answers in this post to make it easy for later reference. Would be great if you add any official links for ref. Any help is really appreciated.

like image 387
Vignesh Murugesan Avatar asked Aug 13 '15 21:08

Vignesh Murugesan


People also ask

What is ATS App transport security?

App Transport Security (ATS) is a privacy feature introduced in iOS 9. It's enabled by default for new apps and enforces secure connections.

How would you explain APP transport security to a new iOS developer?

App Transport Security (ATS) is an iOS feature that forces mobile apps to connect to back-end servers using HTTPS, instead of HTTP, to encrypt data in transit. ATS enforces a minimum security level for communications between a mobile app and web services that support its functionality.

What is Nsallowsarbitraryloads?

A Boolean value indicating whether App Transport Security restrictions are disabled for all network connections.

What is Nsexceptiondomains?

Custom App Transport Security configurations for named domains.


2 Answers

  1. As you said in your updated question, pre-iOS-9 apps are unaffected by ATS, because it only applies to apps linked against the iOS 9 (or later) SDK.

  2. Yes. Disabling ATS globally is fine as long as there's a good reason for doing so.

  3. With iOS 8, I think Apple started requiring apps to be built against the iOS 8 SDK about five months after iOS 8 shipped. So Apple might require you to build against the iOS 9 SDK at some point. Or maybe not. It's anybody's guess.

  4. Yes, iOS apps should be built against the iOS 9 SDK at this point. Linking against the iOS 9 SDK probably won't be required (at least initially), but it is usually a good idea to keep up-to-date.

  5. Yes, you must build against the final iOS 9 SDK version rather than any previous iOS 7 beta SDK.

like image 52
dgatwood Avatar answered Oct 04 '22 21:10

dgatwood


Some of my answers are based on a personal experience, some on openion and some on documented apple guide lines.

  1. It will not function on iOS 9 device.

From a personal experience. I had live app. that was functionning perfectly in iOS 8.2 devices and once iOS 8.3 got released and those devices updated the App. suddenly start crashing.

  1. Set the ATS flag, build with iOS 8 (Xcode 6.X) and submit to the store.

PList is just a text file. It always can have non-recognized items by apple. As we always add values there for 3rd party libraries. I strongly don't think that apple's "current automated checker" will or supposed to check a future flag. and they will function for iOS 9 for the same reason app start crashing on point one!

  1. Yes. Those should include the ATS flag. Otherwise, will be rejected.

Apps that do not perform as advertised by the developer will be rejected. (2. Functionality 2.3)

  1. NO.

Not applicable to force all developers to update their enviroment. They only have to add the flag. Apple never did such a sudden restriction.

  1. True.

Refere to this answer. that shows a screen shot here.

like image 38
hasan Avatar answered Oct 04 '22 20:10

hasan