Questions tagged [app-transport-security]
App Transport Security is a feature that improves the security of connections between an app and web services. The feature consists of default connection requirements that conform to best practices for secure connections. Transport security is available on iOS 9.0 or later, and on OS X 10.11 El Capitan and later.
app-transport-security
247
questions
1601
votes
30
answers
959k
views
Transport security has blocked a cleartext HTTP
What setting do I need to put in my info.plist to enable HTTP mode as per the following error message?
Transport security has blocked a cleartext HTTP (http://) resource
load since it is insecure....
- 27.1k
468
votes
8
answers
446k
views
How do I load an HTTP URL with App Transport Security enabled in iOS 9? [duplicate]
So, the new beta SDK of iOS released last night has "App Transport Security" which encourages developers to use https instead of http. In principle, this is a great idea, and I already use https in ...
- 5,108
307
votes
13
answers
274k
views
How to use NSURLConnection to connect with SSL for an untrusted cert?
I have the following simple code to connect to a SSL webpage
NSMutableURLRequest *urlRequest=[NSMutableURLRequest requestWithURL:url];
[ NSURLConnection sendSynchronousRequest: urlRequest ...
- 14.6k
139
votes
14
answers
229k
views
iOS9 getting error “an SSL error has occurred and a secure connection to the server cannot be made”
Since I upgraded my existing project with iOS 9, I keep getting the error :
An SSL error has occurred and a secure connection to the server cannot be made.
- 1,477
54
votes
5
answers
47k
views
Export Compliance in iOS App Submission
I making a new app and want to submit to app store.
But at the time of final submission
there is check for Export Compliance.
What should I Check Yes Or No.
I use https url in my app.
Please ...
39
votes
2
answers
5k
views
How can I figure out which URL is being blocked by App Transport Security?
I'm upgrading an iOS app to iOS 9, and I have some URLs that are not secure, and I need a few exceptions to App Transport Security. I've added the two that I know about, but there are some warnings ...
- 14.4k
37
votes
9
answers
29k
views
iOS 9 Facebook login simulator -canOpenURL: failed for URL: "fbauth2:///" - error: "(null)"
I've updated to Xcode 7 and the latest iOS SDK. I've added the appropriate entries in my app's plist:
My app's Facebook login works fine on device. However, on iOS 9 simulator, I'm getting:
-...
- 34k
35
votes
2
answers
24k
views
Is it safe to add localhost to App Transport Security (ATS) NSExceptionDomains?
Is it safe, in terms of security, to add localhost to ATS NSExceptionDomains for development use? It's not very convenient (and it's easy to forget) to remove those lines from Info.plist file before ...
- 12.8k
23
votes
4
answers
18k
views
iOS 9 ... Are WebView(s) exempt from the App Transport Security Exceptions (ATS) rules that block insecure HTTP hosts?
In iOS 9, Apple is blocking insecure HTTP connections for apps, unless specific hosts are whitelisted.
http://ste.vn/2015/06/10/configuring-app-transport-security-ios-9-osx-10-11/
Are WebView(s) ...
- 4,976
23
votes
5
answers
33k
views
kCFStreamErrorDomainSSL, -9802 when connecting to a server by IP address through HTTPS in iOS 9
We have an iOS app that connects to our server through HTTPS. When the app is built with the new iOS 9 SDK and ran under iOS 9, the following error occurs:
NSURLSession/NSURLConnection HTTP load ...
- 302
22
votes
3
answers
23k
views
"This app is not allowed to query for scheme cydia" IOS9 error
I have an app where I hit a HTTP Request
<NSURLConnection: 0x12d755110> { request: <NSMutableURLRequest: 0x12d754e10> { URL: http://XX.XX.XX.XXX/webService/dataService.svc/SearchLocation }...
- 1,229
19
votes
3
answers
10k
views
FireBase error -9806, SSL error -1200
I'm using the new FireBase SDK introduced at I/O 2016 and I'm getting this error after integrating with my app. This happens at app launch.
2016-08-06 06:28:06.237 MyApp[49084:2511094] CFNetwork ...
- 4,101
18
votes
4
answers
15k
views
Best way for verifying server compliance to Apple's ATS / TLS 1.2 requirement
So Apple requires TLS 1.2 with Forward Secrecy for URLs beginning iOS 9. Independent of the app, what's the best way to verify that a server meets all the requirements?
nscurl just outright doesn't ...
- 1,248
16
votes
1
answer
17k
views
App TranSport security, allow arbitrary load not working after upgrade to IOS 10.1
I have an app that works fine in ios 9 and 10.0 (I have add the App Transport Security blocking with “Allow Arbitrary Loads = YES” to my info.plist. But after upgrade to 10.1 and Xcode 8.1 there seem ...
- 2,591
12
votes
5
answers
2k
views
Intermittent SSL errors from iOS app to AWS Elastic Beanstalk backend
My iOS app has had intermittent SSL errors when making HTTPS requests to the backend for several months.
The error description:
An SSL error has occurred and a secure connection to the server cannot ...
- 10.8k
11
votes
1
answer
2k
views
Bug in iOS 9 when using client SSL certs and generating HTTP 403 errors
I think we just discovered a bug on iOS 9 (version as of Oct 23rd 2015) when using client SSL certs to talk to a backend API. In common with a lot of REST services, our API generates 4xx error codes ...
- 1,406
10
votes
2
answers
7k
views
Disable App Transport Security in Xcode 9.2?
I cannot disable App Transport Security (ATS) in Xcode 9.2. I have been (for years) disabling ATS when running builds against my local server environment like so:
Transport security has blocked a ...
- 4,723
10
votes
2
answers
35k
views
How to Enable TLS 1.2, 1.1,1.0, and SSL in iOS app?
My question is related to Apple Transport Security (ATS) and I am too much confused.
I want to support all the protocols (all version of TLS and SSL) in my swift app. If I change ...
- 141
10
votes
1
answer
10k
views
What is NSExceptionDomains and when should I use it?
New to iOS with networking programming.
Please any one help to understand that?
<key>NSExceptionDomains</key>
<dict>
<key><!-- your_remote_server.com / ...
user7088216
9
votes
2
answers
6k
views
WKWebView How to display links to http: pages
I have a WKWebView which will display users' webpages using links gathered online.
Sometimes these links are http: which are blocked by ATS.
I've tried simply changing the links to https:, which works ...
- 147
9
votes
2
answers
17k
views
AFNetworking - HTTP load failed (error code: -999) swift iOS
I am using AFNetworking with iOS 11. I am getting error like:
Task <2EC9C49F-1889-4BFF-83B4-2047ED6E5F2A>.<1> HTTP load failed (error code: -999 [1:89])
Error(countries.php): Error Domain=...
- 743
9
votes
1
answer
432
views
App crash using App Transport Security in iOS9
I have upgraded Xcode to Xcode 7 and included App Transport Security(ATS) feature in pList. Currently I have disabled this feature by assigning YES to NSAllowsArbitraryLoads. Now app is running fine ...
- 1,060
8
votes
3
answers
7k
views
WKWebView custom URL scheme doesn't work with https? (mixed content blocked)
I have a WKWebView to load a website that has a custom url scheme (mycustomurl://) implemented with WKURLScheme, which the website will call using GET. Everything works as expected when the website is ...
- 93
8
votes
1
answer
14k
views
“an ssl error has occurred and a secure connection to the server cannot be made” connecting to Internal Development Server on phone only
I developed a iOS app that connects to a internal web server. When I used the simulator, it works fine, but when I build the same app on a iPhone, it gives me a error message “an ssl error has ...
- 1,787
8
votes
1
answer
651
views
App Transport Security issue with AVAudioPlayer loading local file objective-C, XCode 9
I have an app which loads a bundled m4a audio file as a local resource and it has worked well for many years now. I'm updating the app to iOS 11.3/XCode 9.3 and it is now failing on iPad (works on ...
- 6,565
7
votes
2
answers
15k
views
React-native loading image over https works while http does not work
I want to load an Image in the iOS simulator over a http uri as source. But nothing is shown on the screen expect the wireframe which can be made visible with the inspector.
If you load the same code ...
- 1,586
7
votes
2
answers
2k
views
iOS 9 ATS - Disable Forward Secrecy for all domains
With ATS enabled in iOS 9 many of my customers are unable to meet the forward secrecy requirement. They can however meet the https and TLS 1.2 requirements. Due to this I would like to relax the ...
- 918
7
votes
2
answers
4k
views
What is the difference between NSExceptionAllowsInsecureHTTPLoads and NSThirdPartyExceptionAllowsInsecureHTTPLoads?
In iOS 9, I can add keys to my info.plist to disable App Transport Security. There are two keys, NSExceptionAllowsInsecureHTTPLoads and NSThirdPartyExceptionAllowsInsecureHTTPLoads, which are defined ...
- 25.7k
6
votes
2
answers
9k
views
Switching from http to https in iOS App brings up Export Compliance issues when publishing
We recently decided to update a couple of our apps this summer to switch them from http to https in order to follow the new Apple guidelines which go into affect January 2017.
The only thing ...
- 169
6
votes
3
answers
1k
views
Break on kCFStreamErrorDomainSSL
I'm trying to debug an app that makes a lot of HTTP calls. I'm seeing this in the console:
2015-09-08 17:21:01.458 MyApp[3186:3064431] NSURLSession/NSURLConnection HTTP load failed (...
- 18.7k
5
votes
2
answers
4k
views
Api Call Error in Xcode 7 / iOS 9 (how to setup App Transport Security in plist)
I am using xcode 7 beta version.
Now, I am working an API. If, I use the API in Xcode 6.3 it works fine but when same API I used in xcode 7 error message appears Unable to parse.
here is the API i am ...
- 293
5
votes
2
answers
5k
views
Error loading web in UIWebView
I'm using an UIWebView and I can't load facebook. I have to say that I'm using xcode 7 beta 2 and iOS 9.0 beta 4.
This is the error:
Error Domain=NSURLErrorDomain Code=-1022 "The resource could ...
- 984
5
votes
3
answers
2k
views
App Transport Security, exception domain issue
In an iOS app, I am having troubles with App Transport Security:
I have read many post on the net, but for some reason what I set in my Info.plist seems to be ignored. I have tried several ...
- 11k
5
votes
2
answers
2k
views
Safe and reliable way to enable NSAppTransportSecurity for Release configuration and disable it for Debug/Staging configurations?
The question says it all.
I am aware of NSAllowsArbitraryLoads that can be taken together NSExceptionDomains but I am bit confused by this blacklisting approach: I don't want to disable ATS for ...
- 11.3k
5
votes
2
answers
2k
views
App Transport Security blocks HTTPS
I've a problem with ATS.
I'm using XCode 9.1, my Development Target is 11.0.
I'm developing using react-native 0.49
My program is doing a fetch to a https (https://www.xxxx.com) resource which has a ...
- 103
5
votes
1
answer
20k
views
iOS 11 : SSL error occurred and connection to server cannot be made
When I’m trying to connect with Server (which is IIS) I’m getting below error on console window :
API error: An SSL error has occurred and a secure connection to the server cannot be made.
and hence ...
- 36.1k
5
votes
4
answers
3k
views
WKWebView http -> https redirection for iOS 10 ATS Compliance
iOS 10 has foisted https upon us and totally broken an application I'm developing. The application is partly an RSS reader. The URLs we get from the RSS feeds are often HTTP URLs, both for the sites, ...
- 5,063
4
votes
2
answers
7k
views
IOS 9 App Transport Security has blocked a cleartext HTTP Issue
I am testing my app in Xcode 7, IOS 9 and got the following error :
App Transport Security has blocked a cleartext HTTP (http://) resource load since it is insecure. Temporary exceptions can be ...
- 231
4
votes
1
answer
3k
views
App Transport Security verbose
Is there a way to make App transport security more verbose? When my app makes an http call I will get notified in the Xcode console. However it doesn't tell me which http request is triggering the ...
- 4,764
4
votes
1
answer
808
views
How do you change App Transport Security Settings based on the build configuration?
I have an app with multiple build configurations. If the selected configuration is Debug, I want NSAllowsArbitraryLoads key in the Info.plist file to be set as YES, else I want it to be set as NO.
...
- 871
4
votes
2
answers
3k
views
ios9 self signed certificate and app transport security
I've spent a while trying to get this working. I have an API that I'm connecting to that i'm trying to switch to SSL with self signed certificates. I have control on the server and app.
I generated a ...
- 5,952
4
votes
2
answers
355
views
Will Application Transport Security be turned-OFF for apps build for iOS 8 or lower?
If a user has an iPad running my app on iOS 8.4, will ATS be enforced or turned-off by default when the user upgrades to iOS 9? I could not find any official documentation on this behavior. Any ...
4
votes
2
answers
650
views
Parse-Server Not Downloading PFFile due to App Transport Security
I'm in the process of migrating from Parse's backend to the Parse-server on Heroku and MongoDB.
I had everything working smoothly (including loading PFFiles) with this new backend change, however, I'...
- 192
4
votes
1
answer
303
views
Secure communication between iOS app and Raspberry Pi
I want to create secure communication channel between my RPI and iOS 11 mobile application in local environment. My RPI is running a python API code and my iOS mobile app creates different API calls ...
- 43
4
votes
4
answers
6k
views
Embedded AVPlayer is not playing video
I am trying to embed video player using Swift. When I run the app, I can see the video player but video is not playing. Could you check out any missing point, please? Thanks in advance.
var ...
- 305
4
votes
3
answers
2k
views
iOS Objective C HTTPS request failing
I've searched extensively and have made the necessary changes (so i think) to conform to Appl'es ATS restrictions.
Private key 2048 bits or greater
openssl rsa -in privkey.pem -text -noout
Private-...
- 145
4
votes
2
answers
3k
views
Problems with SFSafariViewController
As part of the iOS 9 ATS changes I'm updating an app to use SFSafariViewController for third-party http websites.
When I init and present the instance all I get is a blank white view. No navigation ...
- 269
4
votes
2
answers
2k
views
App Transport Security breaks Web View
My app which works great under iOS8 no longer runs under iOS9. The problem is that despite having the following in my .plist file:
<key>NSAppTransportSecurity</key>
<dict>
<!-...
- 4,097
4
votes
2
answers
314
views
How do I make use of SSLSetALPNProtocols?
I'm working on a TLS library for the vapor project and am supporting both Apple's (Transport-)Security and OpenSSL for use in an HTTP/2 client and server.
On this line of code I'm trying to call ...
- 930
4
votes
1
answer
585
views
iOS ATS configuration for handling internal redirects to HTTP connection
As announced in WWDC 2016, Apple will enforce HTTPS connection for all apps from December end 2016.
Although I have added all the HTTP domains to which my app communicates as exceptions in the ATS ...
- 289