NSAppTransportSecurity: Not working with correct settings

Question

As many developers out there I get some data from a webserver via http. Since XCOde7/iOS9 I need to mark the used domains as an exception in my apps plist. This worked out for all of my domains except one.

Important: It is no solution for me to accept all domains with NSAllowsArbitraryLoads. First I tried the following entries in the plist:

<key>cc.mydomain.de</key>
        <dict>
            <key>NSIncludesSubdomains</key>
            <true/>
            <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
            <true/>
        </dict>

This configuration worked for all the other domains but not for this one so I added the following entries to the plist:

<key>NSThirdPartyExceptionRequiresForwardSecrecy</key>
     <false/>
<key>NSThirdPartyExceptionAllowsInsecureHTTPLoads</key>
     <true/>
<key>NSExceptionRequiresForwardSecrecy</key>
    <false/>

But I still got an error when trying to access the domain.

App Transport Security has blocked a cleartext HTTP (http://) resource load since it is insecure. Temporary exceptions can be configured via your app's Info.plist file

If these exception entries dont work then what is working? What is the minimum configuration for an exception like that. Which entry am I missing?

Philipp Otto · Accepted Answer · 2017-09-12T11:23:13.967

I contacted Apple Developer support for this issue and they told me the problem is that one of my urls redirects to another url which of course has to be listed as an exception in my plist, too. You can easily determine the redirection with the url session delegate method for redirection:

self.session = NSURLSession(configuration: NSURLSessionConfiguration.defaultSessionConfiguration(), delegate: self, delegateQueue: NSOperationQueue.mainQueue())

let url = NSURL(string: "yoururl")!

self.session.dataTaskWithURL(url) { (data, response, error) in
    if let error = error {
        NSLog("error %@ / %d", error.domain, error.code)
    } else if let response = response as? NSHTTPURLResponse {
        NSLog("response %d", response.statusCode)
    } else {
        fatalError()
    }
}.resume()

func URLSession(session: NSURLSession, task: NSURLSessionTask, willPerformHTTPRedirection response: NSHTTPURLResponse, newRequest request: NSURLRequest, completionHandler: (NSURLRequest?) -> Void) {
        NSLog("direct to %@", request.URL!)
        completionHandler(request)
}

Swift 3 version:

class ViewController: UIViewController, URLSessionTaskDelegate {

    var session: URLSession! = nil

    override func viewDidLoad() {
         super.viewDidLoad()

         self.session = URLSession(configuration: URLSessionConfiguration.default, delegate: self, delegateQueue: OperationQueue.main)

         let url = NSURL(string: "yoururl")!

         self.session.dataTask(with: url as URL) { (data, response, error) in
             if let error = error {
                 NSLog("error %@ / %d", (error as NSError).domain, (error as NSError).code)
             } else if let response = response as? HTTPURLResponse {
                 NSLog("response %d", response.statusCode)
             } else {
                 fatalError()
             }
             }.resume()
     }

     func urlSession(_ session: URLSession, task: URLSessionTask, willPerformHTTPRedirection response: HTTPURLResponse, newRequest request: URLRequest, completionHandler: @escaping (URLRequest?) -> Void) {
         print("direct to %@", request.url!)
         completionHandler(request)
     }
}

J.Williams · Answer 2 · 2015-11-09T09:23:56.063

0

Try this:

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <!-- .......................... -->
    <!-- Other keys already present -->
    <!-- .......................... -->

    <key>NSAppTransportSecurity</key>
    <dict>

        <key>NSExceptionDomains</key>
        <dict> 

            <key>mydomain.de</key>
            <dict>
                <key>NSExceptionAllowsInsecureHTTPLoads</key>
                <true/>
                <key>NSIncludesSubdomains</key>
                <true/>
            </dict>

        </dict>
    </dict>

</dict>
</plist>

edited Nov 09 '15 at 09:23

answered Oct 08 '15 at 15:07

J.Williams

1,417
1
20
22

Hey. Thanks for your reply. Unfortunately it is not working either. At the moment I think the problem is not the plist configuration but the url or the webservice itself because it refers to an image rendering ASP.NET service – Philipp Otto Oct 13 '15 at 07:57

score 0 · Answer 3 · answered Oct 27 '15 at 09:53

0

To access the resource from http:// , you need to add the following lines in info.plist file

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <true/>
</dict>

answered Oct 27 '15 at 09:53

Abhishek

3,304
4
30
44

Please read my question where I said: Important: It is no solution for me to accept all domains with NSAllowsArbitraryLoads. – Philipp Otto Oct 27 '15 at 10:17

score 0 · Answer 4 · answered Apr 12 '16 at 12:34

I added App Transport Security Settings but the error was still appearing in the console.

My app was showing this error when I ran a web url in UIWebView. If your page has some inner url/frame which is added to your info.plist as Exception Domains then the error will appear in console.

In my case I was calling a webpage in a UIWebView and this page was having a facebook plugin. This web page was loading properly but was showing this error also in the console. When I thoroughly checked I found that in my app I used Facebook login and for this Facebook tutorial instructed me to add facebook.com as Exception Domains in the info.plist.

When I removed this Exception Domains, the error was gone.

NSAppTransportSecurity: Not working with correct settings

4 Answers4