iOS 10: Apple transport security "exception domains" no longer working

Question

I'm using iOS 10 beta 8, Xcode 8 beta 6.

Regarding Apple Transport Security (ATS) I'm finding that using "exception domains" isn't working in iOS10, but "allow arbitrary loads does". Anyone else confirm?

(I've removed the domain name from the image; this is an enterprise application and won't be affected by the app store ignoring ATS exceptions)

Answer 1

Exception domains method works on me. Xcode 8.21, mac os 10.12.3 and react-native 0.42.3.

After modify the plist in xcode or text-editor mode as follows, you should close the terminal and simulator and restart it.

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>example1.com</key>
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSExceptionRequiresForwardSecrecy</key>
            <false/>
            <key>NSIncludesSubdomains</key>
            <true/>
        </dict>
        <key>example2.org</key>
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSExceptionRequiresForwardSecrecy</key>
            <false/>
            <key>NSIncludesSubdomains</key>
            <true/>
        </dict>
    </dict>
    <key>NSAllowsLocalNetworking</key>
    <true/>
</dict>

Answer 2

You have to use NSAllowsArbitraryLoads in App transportation Security. I was having same issue but now it is resolved.

Answer 3

This might not be your problem but it solved mine.

The domain you type has to be the domain that will typically display in a browser i.e. if in your code you use http://www.example.com you should use www.example.com instead. or http://example.com should instead be example.com in plist

<key>NSAppTransportSecurity</key>
<dict>
  <key>NSExceptionDomains</key>
  <dict>
    <!-- Replace example.com with www.example.com if that is what you registered on your hosting service-->
    <key>example.com</key>
    <!-- instead of http://example.com -->
    <dict>
      <key>NSExceptionAllowsInsecureHTTPLoads</key>
      <true/>
      <key>NSIncludesSubdomains</key>
      <true/>
    </dict>
  </dict>
</dict>