iOS 9 ... Are WebView(s) exempt from the App Transport Security Exceptions (ATS) rules that block insecure HTTP hosts?

Asked 26/6, 2015 at 4:54 Answered 29/12, 2016 at 20:14

Solved ios uiwebview ios9 wkwebview app-transport-security

In iOS 9, Apple is blocking insecure HTTP connections for apps, unless specific hosts are whitelisted.

http://ste.vn/2015/06/10/configuring-app-transport-security-ios-9-osx-10-11/

Are WebView(s) exempt from these rules for obvious reasons, or are we still expected to whitelist hosts that a browser opens... including all links from a given page?

I wasn't sure if this was our responsibility or if that was exempt.

Vasileior answered 26/6, 2015 at 4:54 Comment(1)

This might explain what is behind ATS - medium.com/@Mrugraj/app-transport-security-b7910c4fc70f – Saxe 18/9, 2015 at 12:13

SFSafariViewController can show HTTP without the NSAppTransportSecurity key.

UIWebView and WKWebView require the NSAppTransportSecurity key mentioned above to display HTTP pages.

Headcheese answered 15/7, 2015 at 9:45 Comment(3)

Do you have a source for this or actual confirmation? Because that's not what @Scooter said was his experience with SFSafariViewController. – Vasileior 15/7, 2015 at 10:0

I tried this project (which does not have the NSAppTransportSecurity key) github.com/MShahmeer/SFSafariViewController-Test .. then changed it to load UIWebView and WKWebView. The UI and WK did not work with HTTP, but the SafariViewController did. Using Xcode 7.0 beta 3 (7A152u). Using simulator (haven't got iOS 9 device) – Headcheese 15/7, 2015 at 10:15

I had a similar experience, on finding the answer to my question here: #32993820. Even if you add a domain as an exception which loads on your UIWebView (I can't speak for the other 2 since I haven't tried), if that domain requests other insecure sources, it will block those requests inside the UIWebView as well. – Hexylresorcinol 7/10, 2015 at 15:14

I have inserted the following in my apps .plist per the Apple Guidance:

<key>NSAppTransportSecurity</key>
<dict>
     <!--Include to allow all connections - with and without SSL (DANGEROUS)-->
     <key>NSAllowsArbitraryLoads</key>
     <true/>
</dict>

and when I try to load my webView (from an HTTPS server no less), I get the following error and it doesn't load.

NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9813)

So I it looks like not only are they not exempt, they don't work even if you make the correct addition to the .plist.

Gummy answered 8/7, 2015 at 22:43 Comment(8)

Have you had the chance to try the new "SFSafariViewController"? I'm wondering if that's exempt. – Vasileior 13/7, 2015 at 15:53

I hadn't heard of that one. I will give that a try tonight and see what I get. – Gummy 13/7, 2015 at 17:16

Still not working correctly for me. The way the app was written was that I was pulling a .pdf down from my web server directly into the UIWebView to display it. The web server requires basic authentication which I was providing using NSURLSession earlier in the app. Under iOS 9 though something has changed, and the UIWebView is no longer granted access. The workaround I have implemented is to simply download the .pdf to the documents directory, then load the UIWebView using the local url instead. It works fine, but I still wish I knew why the old way of doing this has quit working. – Gummy 15/7, 2015 at 1:17

That sucks. If you keep tinkering with it let me know if you have any updates. For now I'm OK with including the "arbitrary loads" flag in the transport security exceptions but I'm against it longterm. – Vasileior 15/7, 2015 at 4:32

Will do. I am not sure how you can avoid the arbitrary loads though. I doubt any website will use TLS 1.2 exclusively, which is what App Transport Security is looking for. On my own private server I have configured Apache to use TLS 1.2 only, and it still caused trouble unless I set the arbitrary loads flag. Overall kinda frustrating. – Gummy 15/7, 2015 at 4:36

Yeah I mean I'm basically just waiting for a way to Web Views to be exempt. There'll have to be some sort of exclusion for those since it's normal behavior to be able to visit insecure sites even on the local LAN. – Vasileior 15/7, 2015 at 6:53

I'm having the same problem, reported here: http://stackoverflow.com/questions/31937811/ios-another-error-using-app-transport-security-ats-9813 – Prolix 11/8, 2015 at 9:51

David, this link is broken. Could you please update it? Thanks! – Gummy 13/8, 2015 at 1:5

This question was originally about iOS 9; however, according to Apple's documentation:

Starting in iOS 10.0 and later, the following subkeys are supported:

NSAllowsArbitraryLoadsInWebContent

...

Use NSAllowsArbitraryLoadsInWebContent so that you do not need to white list each page a WebView may load.

Keep NSAllowsArbitraryLoads to maintain backward compatibility with iOS 9 and enable the new setting in your Xcode 8 project Info.plist here:

Mudstone answered 29/12, 2016 at 20:14 Comment(0)

If your app (a third-party web browser, for instance) needs to load arbitrary content, Apple provides a way to disable ATS altogether, but I suspect it’s wise for you to use this capability sparingly:

<key>NSAppTransportSecurity</key>
    <dict>
        <!--Include to allow all connections (DANGER)-->
        <key>NSAllowsArbitraryLoads</key>
        <true/>
    </dict>

Amphora answered 8/10, 2015 at 6:8 Comment(0)

Recommended topics

Hot tags