App Transport Security

What is App Transport Security?

App Transport Security (ATS) is an iOS security feature that enforces secure network connections. It requires all HTTP connections to use HTTPS with TLS 1.2 or higher, forward secrecy, and valid certificates.

Why ATS Matters

ATS protects users from:

• Man-in-the-middle attacks
• Cleartext data transmission
• Weak encryption protocols
• Invalid or expired certificates

How ATS Works

By default, ATS blocks all non-HTTPS connections. When you try to make an HTTP request without ATS exceptions, iOS returns an error.

// This will fail with ATS enabled
let url = URL(string: "http://example.com/api/data")!
let request = URLRequest(url: url)
// Error: App Transport Security has blocked a cleartext HTTP connection

Configuring ATS in Info.plist

ATS is configured in your Info.plist file under NSAppTransportSecurity:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsArbitraryLoads</key>
    <false/>
</dict>

NSAllowsArbitraryLoads set to false is the default and recommended setting. This enforces HTTPS for all connections.

When to Disable ATS

You should only disable ATS or create exceptions when:

• You must connect to a legacy server that does not support HTTPS
• You are loading content from HTTP-only third-party services
• Development and testing environments require HTTP

Never disable ATS in production without a compelling reason. Apple requires justification when submitting apps with ATS exceptions.

Using Exception Domains

Instead of disabling ATS entirely, create exceptions for specific domains:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>legacy-server.example.com</key>
        <dict>
            <key>NSExceptionAllowsInsecureHTTPLoads</key>
            <true/>
            <key>NSIncludesSubdomains</key>
            <true/>
        </dict>
    </dict>
</dict>

Exception Domain Keys

• NSExceptionAllowsInsecureHTTPLoads: Allows HTTP for this specific domain
• NSExceptionMinimumTLSVersion: Sets the minimum TLS version (e.g., TLSv1.2)
• NSIncludesSubdomains: Applies the exception to all subdomains
• NSRequiresCertificateTransparency: Requires certificate transparency

Granular TLS Configuration

<key>NSExceptionDomains</key>
<dict>
    <key>api.example.com</key>
    <dict>
        <key>NSExceptionMinimumTLSVersion</key>
        <string>TLSv1.3</string>
        <key>NSRequiresCertificateTransparency</key>
        <true/>
    </dict>
</dict>

Development Exceptions

For development, you can allow local network connections:

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSAllowsLocalNetworking</key>
    <true/>
</dict>

This allows HTTP connections to localhost and IP addresses on the local network without affecting production security.

Validating ATS Configuration

Use the following approach to audit your ATS settings:

1. Search Info.plist for NSAllowsArbitraryLoads
2. If true, determine if it is necessary
3. Replace with specific domain exceptions where possible
4. Document why each exception exists
5. Test that connections still work after tightening restrictions

Follow the Principle of Least Privilege

Only create exceptions for domains that genuinely require HTTP. Each exception is a potential security vulnerability.

Use NSAllowsLocalNetworking

For development servers running on localhost, use NSAllowsLocalNetworking instead of NSAllowsArbitraryLoads. This only affects local network connections.

Migrate to HTTPS

The best solution is to migrate all endpoints to HTTPS. Modern hosting providers offer free SSL certificates through Let Encrypt. Use tools to identify HTTP resources in your codebase.

Certificate Pinning

For high-security apps, implement certificate pinning to prevent man-in-the-middle attacks even on HTTPS connections:

class PinnedSessionDelegate: NSObject, URLSessionDelegate {
    func urlSession(_ session: URLSession,
                    didReceive challenge: URLAuthenticationChallenge,
                    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        guard let serverTrust = challenge.protectionSpace.serverTrust,
              let certificate = SecTrustGetCertificateAtIndex(serverTrust, 0) else {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        
        let serverCertData = SecCertificateCopyData(certificate) as Data
        let pinnedCertData = Bundle.main.path(forResource: "pinned-cert", ofType: "cer")!
        
        guard let pinnedData = try? Data(contentsOf: URL(fileURLWithPath: pinnedCertData)) else {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        
        if serverCertData == pinnedData {
            completionHandler(.useCredential, URLCredential(trust: serverTrust))
        } else {
            completionHandler(.cancelAuthenticationChallenge, nil)
        }
    }
}

Monitor ATS Violations

Add logging for ATS failures to identify new HTTP endpoints that need migration. Use network monitoring tools to track cleartext traffic attempts.

App Store Requirements

Apple reviews apps with ATS exceptions. You must provide a valid reason for each exception. Apps that disable ATS without justification may be rejected during review.