Apple announced "App Transport Security" for iOS9 & EI Capitan OSX 10.11.
ATS(App Transport Security), an app add a declaration to its info.plist that specifies the domain which it needs secure communication. It prevents accidental disclosure, security and easy to adopt. If you were developing an app, you should use HTTPS exclusively. Because if your application attempts to any HTTP server that doesnot support SSL technology.
By passing app-security.
To configure domain exception, your app can connect to non-secure and add these keys to info.plist (Xcode7 doesnot currently auto complete these keys)
Do changes in info.plist
For example you can add a domain specific like:
<key>NSAppTransportSecurity</key>
<dict>
<key>NSExceptionDomains</key>
<dict>
<key>YOUR_DOMAIN_NAME</key>
<dict>
<key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key><true>
<key>NSIncludesSubdomains</key><true>
<key>NSTemporaryExceptionMinimumTLSVersion</key><string>TLSv1.1</string>
</true></true></dict>
</dict>
</dict>
Alternate solution
If I do not know all insecure domains, then use
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key><true>
<dict>
ATS(App Transport Security), an app add a declaration to its info.plist that specifies the domain which it needs secure communication. It prevents accidental disclosure, security and easy to adopt. If you were developing an app, you should use HTTPS exclusively. Because if your application attempts to any HTTP server that doesnot support SSL technology.
By passing app-security.
To configure domain exception, your app can connect to non-secure and add these keys to info.plist (Xcode7 doesnot currently auto complete these keys)
Do changes in info.plist
For example you can add a domain specific like:
<key>NSAppTransportSecurity</key>
<dict>
<key>NSExceptionDomains</key>
<dict>
<key>YOUR_DOMAIN_NAME</key>
<dict>
<key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key><true>
<key>NSIncludesSubdomains</key><true>
<key>NSTemporaryExceptionMinimumTLSVersion</key><string>TLSv1.1</string>
</true></true></dict>
</dict>
</dict>
Alternate solution
If I do not know all insecure domains, then use
<key>NSAppTransportSecurity</key>
<dict>
<key>NSAllowsArbitraryLoads</key><true>
<dict>
Hi, what about when the app is not an app but a sh script?
ReplyDeleteIn my case It works for me passing the URL as https.
DeleteHi Joseba, If you were developing an app using "HTTPS", then no issues. Although we can use with "HTTP" too with bypassing condition (.plist)
Delete