Application Transport Security ?

App & System Services Core OS
Arnonymous
Arnonymous OP
Created Jun ’15
Replies 33
Boosts 0
Views 288k
Participants

When I try to start an URL Request to my website from watchOS 2 the request fail and i get this message :


Application Transport Security has blocked a cleartext HTTP (http://) resource load since it is insecure. Temporary exceptions can be configured via your app's Info.plist file.


what can i do ? All i've found in the doc is :


App Transport Security

App Transport Security (ATS) lets an app add a declaration to its 

Info.plist
file that specifies the domains with which it needs secure communication. ATS prevents accidental disclosure, provides secure default behavior, and is easy to adopt. You should adopt ATS as soon as possible, regardless of whether you’re creating a new app or updating an existing one.

If you’re developing a new app, you should use HTTPS exclusively. If you have an existing app, you should use HTTPS as much as you can right now, and create a plan for migrating the rest of your app as soon as possible.


But nothing about the name of the key in Info.plist..

Answered by DTS Engineer in 642411022
I only just noticed this thread and I have some concerns about the accepted answer here. Apple strongly recommends against completely disable ATS by setting the NSAllowsArbitraryLoads key. This key is intended to be used in situations where you have to connect to arbitrary user-specified servers, and thus can’t statically declare your ATS requirements in your Info.plist. For example, imagine you’re building a tool where the user can enter an arbitrary URL and you fetch that URL and display the returned headers. The user might enter any sort of URL, including an http URL, or one to a server whose TLS setup is broken, and you still need to work with it. That’s a perfect use case for NSAllowsArbitraryLoads.

In cases like this one, where you’re trying to connect to a single server, our advice is:

  • If possible, fix the server to be ATS compatible. This yields the best security which, after all, is the whole purpose of ATS.

  • If you can’t fix the server, apply a targeted exception using NSExceptionDomains rather disabling ATS entirely using NSAllowsArbitraryLoads.

For more background on ATS, see Preventing Insecure Network Connections and the associated NSAppTransportSecurity reference.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
Replies  33
Boosts  0
Views  288k
Participants  
mattryan
mattryan OP
Jun ’15
Accepted Answer

Adding the following to your Info.plist will disable ATS


<key>NSAppTransportSecurity</key>
     <dict>
          <key>NSAllowsArbitraryLoads</key><true/>
     </dict>
1
Rumple
Rumple OP
Jun ’15

Where in the doc did you find this information? Is there more useful information?


Tag: App Transport Security

0
stevenp
stevenp OP
Jun ’15

It's not in the documentation. I found it by doing a search of the contents of the CFNetwork binary. There are other keys, but I haven't figured out how to use them yet.

0
Jeroen
Jeroen OP
Jun ’15

The info you are looking for:

NSAppTransportSecurity
NSExceptionDomains
"example.com"
NSIncludesSubdomains = YES
NSExceptionRequiresForwardSecrecy = NO
NSExceptionMinimumTLSVersion = "TLSv1.1"

Check it out in WWDC session 711

https://developer.apple.com/videos/wwdc/2015/?id=711 @ 5:55



🙂

0
Universalis
Universalis OP
Jun ’15

The problem may be that ATS is requiring TLS 1.2-only servers, presumably to prevent attacks that involve downgrades to lower versions of the protocol. Evidence in favour of this is that Amazon servers (which do support TLS 1.2) are also blocked, though with a different code. See the thread at https://forums.developer.apple.com/thread/4017, and DO FILE A BUG REPORT ABOUT THIS. That is what beta testing is for.

0
Saliency
Saliency OP
Jun ’15

This bypass doesn't appear to work anymore on beta 2 -- my app fails to install on either the hardware or on the simulator. Has anyone found a workaround?

0
Saliency
Saliency OP
Jul ’15

How's beta 3 working for you?

0
iPad_dev
iPad_dev OP
Jul ’15

this works on beta 3

0
auco
auco OP
Jul ’15

Dang it: the screenshot in the video was really confusing.


The WWDC video "Networking with NSURLSession" showed this:


<dict>
  <key>NSExceptionDomains</key>
  <dict>
       <key>subdomain.somedomain.com</key>
       <dict>
            <key>NSIncludesSubdomains</key><true/>
            <key>NSExceptionAllowsInsecureHTTPLoads</key><true/>
            <key>NSExceptionRequiresForwardSecrecy</key><false/>
       </dict>
  </dict>
</dict>


but this did not seem to work for IP addresses (e.g. 127.0.0.1 or localhost).

In order to allow any http, you just need the afore mentioned key that seems to opt out completely:


<dict>
  <key>NSAllowsArbitraryLoads</key><true/>
</dict>


note: tried on beta 4

0
LongTiger
LongTiger OP
Aug ’15

It doesn't work with Swift 2 and Xcode7 beta 5 .How to fix it ? pls help me

0
Application Transport Security ?
First post date Last post date
 
 
Q