"Allow Arbitrary Loads = true" not working

My App has In-App Browser. I used `WKWebView` for providing a Browsing feature within the app. So, currently, whenever a User is opening PDF in WKWebView it gets rendered within the WebView first and then if he/she wants to download, we have provided an option to download the PDF where we're making a separate download task call using

+ (NSURLSession *)sessionWithConfiguration:(NSURLSessionConfiguration *)configuration delegate:(nullable id )delegate delegateQueue:(nullable NSOperationQueue *)queue;


Now, the issue is with the download part where I am making a separate request. If user tries to download any file which is HTTP based, the download task gets failed with below error:


{"info":"Error Domain=NSURLErrorDomain Code=-1022 \"The resource could not be loaded because the App Transport Security policy requires the use of a secure connection.\" UserInfo={NSUnderlyingError=0x600001fe36f0 {Error Domain=kCFErrorDomainCFNetwork Code=-1022 \"(null)\"}, NSErrorFailingURLStringKey=http://www.africau.edu/images/default/sample.pdf, NSErrorFailingURLKey=http://www.africau.edu/images/default/sample.pdf, NSLocalizedDescription=The resource could not be loaded because the App Transport Security policy requires the use of a secure connection.}","error":"NSURLErrorDomain","url":"http://www.africau.edu/images/default/sample.pdf"}


In Info.plist I have set

<plist version="1.0">

<dict>

<key>NSAllowsArbitraryLoads</key>

<true/>

<key>NSAllowsArbitraryLoadsInWebContent</key>

<true/>

</dict>

</plist>


So, I assumed that It should allow HTTP requests but, here Its not happening so, if anyone has any clue then please help.


Thanks in Advance!

Replies

A couple of things; it looks like you are seeing this error because you are using NSURLSession to download a file in the clear with HTTP and you are using NSAllowsArbitraryLoadsInWebContent which is used for UIWbView and WKWebView. Second, you are getting this error because you are not adhering to the App Transport Security guidelines on Apple platforms. It is best practice for any network traffic to be secured using HTTPS. If you plan to allow arbitrary loads you will need to provide justification to the App Review team.


Matt Eaton

DTS Engineering, CoreOS

meaton3 at apple.com