Http connection is enabled on Xcode 9.4.1 even App Transport Security Setting is true

Hi All,


I am a little confused what is the root cause that http is always enabled even if



<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key>
<false/>
</dict>


Thanks,

Accepted Reply

I just tested this and HTTP was blocked to me. I suspect I’ve misunderstood what you’re doing. Here’s what I did:

  1. I created a new iOS test app.

  2. I set it up to run this code when I press a Test button:

    NSLog("task start") let url = URL(string: "http://example.com")! let request = URLRequest(url: url, cachePolicy: .reloadIgnoringLocalCacheData, timeoutInterval: 60.0) URLSession.shared.dataTask(with: request) { (data, response, error) in     if let error = error as NSError? {         NSLog("task transport error %@ / %d", error.domain, error.code)         return     }     let response = response as! HTTPURLResponse     let data = data!     NSLog("task finished with status %d, bytes %d", response.statusCode, data.count) }.resume()

    .

  3. I modified the

    Info.plist
    to include this:
    <key>NSAppTransportSecurity</key>
    <dict>
        <key>NSAllowsArbitraryLoads</key>
        <false/>
    </dict>

    Note This isn’t necessary, because

    NSAllowsArbitraryLoads
    defaults to false, but I figured I should try to get as close as possible to your test.
  4. I ran the app and tapped my Test button.

  5. It prints:

    … task start … App Transport Security has blocked a cleartext HTTP (http://) resource load since it is insecure. Temporary exceptions can be configured via your app's Info.plist file. … Cannot start load of Task <4BD0CB27-F571-4D9C-9E31-997B7A918FB3>.<1> since it does not conform to ATS policy … Task <4BD0CB27-F571-4D9C-9E31-997B7A918FB3>.<1> finished with error - code: -1022 … task transport error NSURLErrorDomain / -1022

    .

What are you doing different?

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Replies

I just tested this and HTTP was blocked to me. I suspect I’ve misunderstood what you’re doing. Here’s what I did:

  1. I created a new iOS test app.

  2. I set it up to run this code when I press a Test button:

    NSLog("task start") let url = URL(string: "http://example.com")! let request = URLRequest(url: url, cachePolicy: .reloadIgnoringLocalCacheData, timeoutInterval: 60.0) URLSession.shared.dataTask(with: request) { (data, response, error) in     if let error = error as NSError? {         NSLog("task transport error %@ / %d", error.domain, error.code)         return     }     let response = response as! HTTPURLResponse     let data = data!     NSLog("task finished with status %d, bytes %d", response.statusCode, data.count) }.resume()

    .

  3. I modified the

    Info.plist
    to include this:
    <key>NSAppTransportSecurity</key>
    <dict>
        <key>NSAllowsArbitraryLoads</key>
        <false/>
    </dict>

    Note This isn’t necessary, because

    NSAllowsArbitraryLoads
    defaults to false, but I figured I should try to get as close as possible to your test.
  4. I ran the app and tapped my Test button.

  5. It prints:

    … task start … App Transport Security has blocked a cleartext HTTP (http://) resource load since it is insecure. Temporary exceptions can be configured via your app's Info.plist file. … Cannot start load of Task <4BD0CB27-F571-4D9C-9E31-997B7A918FB3>.<1> since it does not conform to ATS policy … Task <4BD0CB27-F571-4D9C-9E31-997B7A918FB3>.<1> finished with error - code: -1022 … task transport error NSURLErrorDomain / -1022

    .

What are you doing different?

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

What API are you using to perform your HTTP requests?