iOS 10: Apple transport security "exception domains" no longer working

Question

I'm using iOS 10 beta 8, Xcode 8 beta 6.

Regarding Apple Transport Security (ATS) I'm finding that using "exception domains" isn't working in iOS10, but "allow arbitrary loads does". Anyone else confirm?

(I've removed the domain name from the image; this is an enterprise application and won't be affected by the app store ignoring ATS exceptions)

score 9 · Answer 1 · answered Mar 27 '17 at 13:59

Exception domains method works on me. Xcode 8.21, mac os 10.12.3 and react-native 0.42.3.

After modify the plist in xcode or text-editor mode as follows, you should close the terminal and simulator and restart it.

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>example1.com</key>
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSExceptionRequiresForwardSecrecy</key>
            <false/>
            <key>NSIncludesSubdomains</key>
            <true/>
        </dict>
        <key>example2.org</key>
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSExceptionRequiresForwardSecrecy</key>
            <false/>
            <key>NSIncludesSubdomains</key>
            <true/>
        </dict>
    </dict>
    <key>NSAllowsLocalNetworking</key>
    <true/>
</dict>

score 2 · Answer 2 · answered Sep 26 '16 at 09:14

2

You have to use NSAllowsArbitraryLoads in App transportation Security. I was having same issue but now it is resolved.

answered Sep 26 '16 at 09:14

Anand Kr. Avasthi

427
4
14

2

This solution can be used only temporarily because it's insecure and thus not recommended by Apple. – DanSkeel Aug 30 '17 at 10:10

score 2 · Answer 3 · edited Jun 30 '17 at 16:40

This might not be your problem but it solved mine.

The domain you type has to be the domain that will typically display in a browser i.e. if in your code you use http://www.example.com you should use www.example.com instead. or http://example.com should instead be example.com in plist

<key>NSAppTransportSecurity</key>
<dict>
  <key>NSExceptionDomains</key>
  <dict>
    <!-- Replace example.com with www.example.com if that is what you registered on your hosting service-->
    <key>example.com</key>
    <!-- instead of http://example.com -->
    <dict>
      <key>NSExceptionAllowsInsecureHTTPLoads</key>
      <true/>
      <key>NSIncludesSubdomains</key>
      <true/>
    </dict>
  </dict>
</dict>

score 0 · Answer 4 · answered Nov 27 '21 at 15:41

2021 example working fine:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>NSAppTransportSecurity</key>
        <dict>
            <key>NSExceptionDomains</key>
            <dict>
                <key>abcdef.com</key>
                <dict>
                    <key>NSExceptionAllowsInsecureHTTPLoads</key>
                    <true/>
                    <key>NSIncludesSubdomains</key>
                    <true/>
                </dict>
            </dict>
        </dict>
    </dict>
</plist>

Recall for Swift non-storyboard apps, there is by default no Info.plist file.

go to Target (not project), Info
add any key (even a nonsensical one)
that will generate a conventional Info.plist file

Now you can modify the source of the Info.plist file as usual in the simple way.

iOS 10: Apple transport security "exception domains" no longer working

4 Answers4

2021 example working fine: